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MESSAGE FROM THE PRIVACY COMMISSIONER OF CANADA 


MESSAGE FROM 
THE PRIVACY COMMISSIONER 
OF CANADA 


s Privacy Commissioner of Canada, I have the privilege of interacting with many of my 

provincial, territorial and international counterparts. In that capacity, I have come to 

realize how similar are the privacy challenges facing many jurisdictions today and recognize 
the tremendous value of sharing knowledge and experience. Law-makers are struggling to adapt 
traditional legal concepts to the new realities brought on by rapidly-advancing technologies. 
Decision-makers are constantly called upon to re-calibrate the balancing of social interests and 
values in an ever-expanding global economy. 


The Privacy Act, which | am responsible for administering and which governs the protection of 
personal information in the federal public sector, has been in force since 1983. The Protection of 
Personal Information and Electronic Documents Act (PIPEDA), which | am also responsible for 
administering, was adopted more recently in 2000 to extend privacy protection to private-sector 
activity within federal jurisdiction. PIPEDA came into force through staged implementation and 
only took full effect in January 2004. 


By contrast, Québec was the first Canadian jurisdiction to adopt private-sector privacy legislation. 
Its Act respecting the Protection of Personal Information in the Private Sector (Quebec’s Private 
Sector Act) has been in force since 1994. Québec’s Commission daccés a l'information (CAI) and 
Québec courts have thus had more than ten years of experience interpreting and applying the 
various provisions of their Act across numerous sectors and multiple situations. As a result, there 
is a rich body of jurisprudence that has accumulated since 1994, providing important insight for 
other jurisdictions overseeing private sector privacy compliance. 


To tap into this valuable resource, Assistant Commissioner Heather Black and I undertook to 
commission this project which aims to review and summarize Québec’s experience to date. As 
Québec’s Protection of Personal Information in the Private Sector Act was deemed substantially 
similar to the Protection of Personal Information and Electronic Documents Act (PIPEDA) in 
December 2003, this document will prove to be useful as our own Office is called upon to interpret 
and apply similar provisions of PIPEDA. Learning from the experience of Québec and comparing 
our respective approaches may also help inform possible amendments to P/PEDA as our Office 


gears up for the 2006 legislative review. 
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Furthermore, by making this document publicly available in both official languages, we hope to 
enable access by other jurisdictions, particularly in those provinces that have also adopted new 
private sector laws recently deemed to be substantially similar to PIPEDA. Based on consultations 
with some of our provincial counterparts, they too could stand to benefit from the valuable 
experience Québec has accumulated to date in having to interpret and apply similar legal 
concepts. 


It is therefore with great pleasure that we introduce “Learning from a Decade of Experience: 
Québec’s Private Sector Privacy Act’. Assistant Commissioner Heather Black and I would like to 
thank the authors of the document, M* Karl Delwaide and M® Antoine Aylwin of Fasken Martineau 
DuMoulin (Montreal) for their significant contribution to this project. This document is intended 
to be primarily descriptive in nature. Please note that any additional legal commentary offered by 
the authors does not bind our Office. 


We would also like to extend our sincere appreciation to the esteemed members of our External 
Editorial Board for their wise advice in helping us conceptualize this project and for their many 
valuable comments on earlier drafts of the document: 


Madeleine Aubé, General Counsel, Commission d’accés a l’information du Québec 
Frank Work, Alberta Information and Privacy Commissioner 

Mary O’Donaghue, Sr. Counsel, Ontario Information and Privacy Commissioner’s Office 
Jeffrey Kaufman, Fasken Martineau, Toronto 

Murray Rankin, Arvay Finlay, Victoria 


Finally, this document would not be complete without a word of thanks to the OPC staff that led, 
managed and implemented this project on our behalf: 


Patricia Kosseim, General Counsel 

Ann Goldsmith, Legal Counsel 

Maxime Laverdiére, Law Student 

OPC Public Education and Communications Branch 


We hope you will find this document as useful as we have. 


Jennifer Stoddart Heather Black 
Privacy Commissioner of Canada Assistant Privacy Commissioner of Canada 
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rivacy protection is a deeply-held value which transcends the geographical and jurisdictional 

boundaries of most modern democratic states. The right to respect for private life, including 

the right to protection of one’s personal information, is reflected in some of the key 
international human rights instruments that followed World War II. Since the Organization for 
Economic Cooperation and Development (OECD) established a more elaborate framework of 
data protection principles in its Guidelines on the Protection of Privacy and Transborder Flows of 
Personal Data in 1980, systematic efforts have been made at the international level to harmonize 
national laws against this basic standard. 


Through jurisprudential development, Canadian courts have clearly recognized privacy as a 
fundamental right protected by sections 7 and 8 of the Canadian Charter of Rights and Freedoms 
(1982). Privacy goes to the very core of a person’s physical and moral autonomy. Privacy in relation 
to one’s personal information is essential to ensure the basic dignity and integrity of the individual. 
The right to privacy is also explicitly enshrined in the Québec Charter of Human Rights and 
Freedoms (1976) and codified in the Civil Code of Québec (1994), where it has been given a broad 
and liberal interpretation as a keystone value in the civil law regime governing persons and their 
obligations. 


Anchored in this notion of privacy as a fundamental human right, and cognizant of the need to 
align with international standards so as to facilitate trans-border data flows, Canadian legislators 
have moved actively in modern times to adopt comprehensive statutory regimes for privacy 
protection. There are now privacy statutes that exist in nearly all Canadian jurisdictions, at the 
federal, provincial and territorial levels, mostly in the public sector, though increasingly in the 
private sector as well. 


But harmonization of course does not mean uniformity. While jurisdictions may commit to 
subscribe to the same principles, they may choose to go about protecting privacy in locally specific 
ways. Hence, much could be gained by comparing legislative approaches adopted by different 
jurisdictions and learning from the experiences each has accumulated in interpreting and applying 


its respective laws. 


It is in keeping with the method and true spirit of comparative law that this work was commissioned 
by Commissioner Stoddart. Asa member of the External Advisory Board of the Office of the Privacy 
Commissioner of Canada, | commend the openness of her approach and support her efforts aimed 
at promoting mutual learning across jurisdictions and ultimately, advancing privacy law in Canada. 
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This method calls to mind the wisdom and foresight of René David and John E.C. Brierley in their 
work on Major Legal Systems in the World Today, 3" edition (London: Stevens & Sons, 1985): 


It is of course normal that legal practitioners, in their daily work, should 
limit their outlook to their own national law and its political boundaries. 
But there is, on the other hand, no true science of law unless it aspires to be 
universal in scope and in spirit. Comparative law is only one element in this 
new universalism so important today, but it has and will continue to have in 
time... a primary part to play in the progress of law. (p. 17) 


What greater universal interest can there be in today’s world typified by global trade, information 
technology and international security, than the interest of individuals to have their personal 
information protected by those in whom they have chosen to vest their trust. Indeed, privacy lies 
at the heart of free and democratic societies, and it behooves us to constantly seek out ways to better 
understand its boundaries and give it more meaningful effect as a true expression of personhood 
in an increasingly complex world. 


- The Honourable Claire L’Heureux-Dubé, former Justice of the Supreme Court of Canada 
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Summary of case law under An Act respecting the Protection of 


Personal Information in the Private Sector, R.S.Q., c.P-39.1 


1. THE SCOPE OF APPLICATION OF THE QUEBEC PRIVATE SECTOR ACT 
1.0.1 Four principles of the Québec Private Sector Act: 


1. A person or a corporation must have a serious and legitimate reason for establishing a file on 
someone; 


2. Every individual has the right to access his or her file, unless the rights of third parties must be 
protected or there is a serious reason for refusing access; 


3. Every individual has the right to rectify an incorrect, incomplete or obsolete file; and 


4, Every person or corporation that opens a file on an individual has an obligation of 
confidentiality. 


1.0.2 CAT has exclusive jurisdiction to hear and decide “introductory” request for access to an 
individual’s record, when an enterprise is involved. 


(a) Institut dassurance du Canada v. Guay, J.E. 1998-141 (C.Q.). 


(b) Monette v. Westbury Canadienne, compagnie dassurance-vie, {1999} CAI 
B5O0(S..8 


(c) Therien v. News Marketing Canada, J.E. 2001-809 (S.C.). 


1.0.3. This does not bar other administrative tribunals or courts from considering the Québec 
Private Sector Act when exercising their duty to hear and decide questions related to the 
protection of personal information. 


(d) CAI v. Hydro- Québec, [2003] CAI 731 (C.A.); 


(e) L’Ecuyer v. Aéroports de Montréal, [2003] CFPI 573. 


(1.1) 
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Precedence of Québec Private Sector Act over other Québec statutes (section 94) 


The general theory of abuse of right, enshrined at article 7 Code civil de Québec (C.C.Q.), 
is not, in and of itself, sufficient ground to refuse access, because of the precedence of the 
Québec Private Sector Act. 


(a) Boyer v. Société des Casinos du Québec inc., [1997] CAI 345. 


The very purpose of the Québec Private Sector Act, is to establish more particular rules for 
exercising the general rights conferred by the Civil Code of Québec where an enterprise of 
the private sector is involved. 


(a) Monette v. Westbury Canadienne, compagnie dassurance-vie, [1999] CAI 
5p0 (5.C.), 


Beside those grounds expressly set out in the Québec Private Sector Act, only public 
interest can be raised as an exception to the protection and access obligations. 


(a) Morin-Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal 
granted on the application of s. 39(2) J.E. 1997-1950 (C.Q.)); 


(b) X. v. Les Services de Santé du Québec, [1994] CAI 263; 


(c) Duchesne v. Minerais Lac Ltée — La Mine Doyon, {1997] CAI 214 (Motion 
to appeal granted (C.Q., 1997-10-15), Discontinuance of appeal (C.Q., 
1998-04-14)); 


(d) Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, , J.E. 1998-995 
(S.C.) (Appeal rejected, C.A. 2001-11-08); 


(e) Chainé v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27)); 


(f) Chainé v. Paul Revere, Compagnie dassurance-vie, [1998] CAI 139 (Appeal 
rejected (C.Q., 2000-04-27)). 


For example, the right to professional secrecy actually takes precedence over privacy 
legislation. 


(a) Général Accident Compagnie dAssurance du Canada v. Ferland, [1997] 
CAI 446 (Q.C,). 


If an introductory demand is purely a request to access information, it falls within the 
exclusive jurisdiction of the CAI 


(a) Therien v. News Marketing Canada, J.E. 2001-809 (S.C.); 
(b) Grenier v. Equifax Canada Inc., 2003 IJCan 19492 (S.C.); 


(c) Monette v. Westbury Canadienne, compagnie dassurance-vie, [1999] CAI 
5503 .), 


(1,2) 


1:2.1 
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This is true even if some conclusions for damages are annexed to what is essentially a 
demand to rectify a file, the CAI retains its jurisdiction. 
(a) Fernandez v. Takhar Financial, 2003 I1JCan 3252 (C.Q.). 


However, a tribunal may retain exclusive jurisdiction over an access or rectification dispute 
where such arises within the scope of the exclusive jurisdiction attributed to the tribunal. 


(a) CAI v. Hydro- Québec, [2003] CAI 731 (C.A.); 
(b) L’Ecuyer v. Aéroports de Montréal, [2003] CFPI 573. 


The Québec Private Sector Act cannot be used to refuse to give access to documents in the 
course of civil proceedings. 


(a) 9083-2957 Québec inc. v. Caisse populaire de Riviére-des-Prairies, J.E. 
2004-2000 (C.A.). 


What is an “enterprise” under the Québec Private Sector Act? 


In principle, the definition of “enterprise” should be understood in the context of the legal 
field in which it applies in order to allow the legislation to achieve its objects. Four elements 
should be considered in the definition of an “enterprise”: 


1) that the operations of an enterprise constitute jurisdictional acts, which are repetitve; 


2) that there exists a coordination between human and material resources; 


3) that the organization must aim at responding and satisfying certain needs; and 


4) that its success is dependent on similar standards as to market forces and the efforts deployed 


by the business person. 


12.2 


1 Re 


(a) Conseil de presse du Québec v. Lamoureux-Gaboury, 2003 IJCan 33002 
(C.Q.) [This decision was overruled by the Superior Court mainly on 
questions of fact; see Conseil de presse du Québec v. Cour du Québec, B.E. 
2004BE-651 (motion for leave to appeal granted by the Court of Appeal, 
C.A., 2004-10-07)]. 


When determining if an organization is an enterprise, the main activity must be considered, 
not its ancillary activities. 


(a) Congrégation des Témoins de Jéhoyah D’Issoudun-Sud v. Mailly, }.E. 2000- 
1776 (C.Q.). 


In a private clinic, a psychiatrist is carrying on an enterprise, as is any other professional 
who engages in an organized economic activity under the Professional Code, R.S.Q., 
chapter C-26. 


(a) Adam v. Gauthier, [1997] CAI 18; 


1.2.4 


E25 


C26 


2, 


1.2.8 


V9 
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(b) Québec (Sous-ministre du revenu) v. Lasalle, J.E. 97-1575 (C.Q.). 
Unions are persons carrying on an enterprise. 


(a) Gauthier v. Syndicat des employés de la Bibliotheque de Québec, [1997] 
CAI; 


(b) Beaudoin v. Syndicat canadien des communications, de lénergie et du 
papier (S.C.E.P), section locale 530, [2001] CAI 188 (Motion to appeal 
granted (2001-05-15 (C.Q.) and then reversed (2001-10-18 C.Q.)). 


Jehovah Witnesses are not carrying on an enterprise because their purpose is spiritual, not 
economic. 


(a) Bonneville v. Congrégation des Témoins de Jéhovah Valleyfield-Bellerive 
and Procureur général du Québec, [1995] CAI 280; 


(b) Congrégation des Témoins de Jéhovah D'Issoudun-Sud v. Mailly, J.E. 2000- 
17761. 


Religions, like Roman Catholicism, are not subject to the legislation when ruling on 
religious matters concerning relations between individuals and religious authorities. 


(a) Rochette v. Tribunal Ecclésiastique de Québec, A.1.E. 2004AC-2 (CAI). 


Information specifically generated or obtained in the context of litigation (by an enterprise) 
is not part of the carrying on an enterprise. However, actions taken by a law firm to get a 
bill of costs is the carrying on of an enterprise. 


(a) Scarola v. Shell Canada Ltée, 2004 lJCan 41420 (S.C.); 
(b) Reeves v. Fasken Martineau DuMoulin, |2001] CAI 322. 


The Québec Private Sector Act applies to every enterprise that conducts business in 
Québec, independently of the location of its place of business and the place where the 
personal information is stored. 


(a) Institut dassurance du Canada v. Guay, J.E. 1998-141 (C.Q.). 


According to the Superior Court, the Québec Private Sector Act does not apply to some 
aspects of a “federal undertaking,” because it falls within the sole jurisdiction of the Federal 
Parliament. 


(a) Air Canada v. Constant, 2003 IIJCan 1018 (S.C.) (Pending in Appeal, 2003- 
10-02). 


This Superior Court decision overturns case law of the CAI, which has ruled several times 
in favour of the application of Québec Private Sector Act to federal undertakings. 


(a) Pierre v. Fédéral Express Canada Itée, [2003] CAI 139; 


(1.3) 


Ls.1 


132 


A Res I 


1.3.4 


13.5 


Beno) 
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(b) Lamarre v. Banque Laurentienne, CAI # 99 09 63, AZ-50144774, 2002-08- 
21, D. Boissinot, M. Laporte, J. Stoddart; 

(c) Rioux v. Recyclage Kebec inc., [2000] CAI 117; 

(d) Jabre v. Middle East Airlines-AirLiban S.A.L., [1998] CAI 404; 

(e) DeBellefeuille v. Canpar Transport ltée, [1998] CAI 178; 

(f) Laperriére v. Air Canada, {1997} CAI 167, Revision granted on other 


grounds (S.C., 1997-10-08) Appeal dismissed (C.A., 2000-04-20). 


The particular situation of Professional Orders (known in other jurisdictions as 
Professional Regulatory Boards) 


The CAI first ruled that the specific activities of the “syndic” of a professional Order do not 
constitute the carrying on of an enterprise. 


(a) Whitehouse v. Ordre des pharmaciens du Québec, [1995] CAI 252; 
(b) X. v. Corp. professionnelle des médecins du Québec, [1995] CAI 245. 


Afterwards, the CAI concluded in an inquiry report that the Order of Chartered 
Accountants was carrying on an enterprise when providing services to its members. 


(a) X v. Ordre des comptables agréés du Québec, A.LE. 95AC-115 (Inquiry 
Report). 


In December 1995, the Commission decided that professional Orders are not subject to the 
Access to Information (ATI) Act, and are therefore governed by the Québec Private Sector 
Act. 


(a) Pineault v. Ordre des Technologues en radiologie du Québec, [1996] CAI 7. 


In November 1996, the Court of Québec decided that the Insurance Brokers Association 
of Québec, a body similar to a professional Order, is carrying on an enterprise. 


(a) Girard v. Association des courtiers dassurance du Québec, |1997] R.J.Q. 
206 (C.Q.). 


In December 1996, the Superior Court ruled that all functions of professional Orders are 
excluded from the scope of the Québec Private Sector Act. 


(a) Dupré v. Comeau, J.E. 1997-239 (S.C.). 


In 2002, the Commission took the position once again that professional Orders are not 
subject to the application of the ATI Act. 


(a) Fabrikant v. Collége des médecins, [2002] CAI 320. 


Los? 


(1.4) 


1.4.1 


1.4.2 


1.4.3 


1.4.4 


1.4.5 


1.4.6 


1.4.7 
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Files of professional Orders may then only be accessed by filing a motion before the 
Superior Court under articles 38 and 40 C.C.Q. 
(a) Farhat v. Lalonde, [1999] CAI 544. 
The definition of personal information 


Only information relating to natural persons, in their capacity as individuals, is protected 
under the Québec Private Sector Act. 


(a) Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67; 


(b) Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 
(S.C.) (Appeal rejected, C.A. 2001-11-08); 


(c) Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] CAI 
316. 


The notes of an attorney are accessible to his own client when the information contained 
therein relates to a natural person and allows him to be identified. 


(a) Hudon v. Desrosiers, [1996] CAI 189. 


All the notes that can relate to the identification of individuals are considered personal 
information. 


(a) Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E.97-1951 (C.Q.), 
[confirmed by Superior Court: Assurance-vie Desjardins-Laurentienne inc. 
v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08)]. 


The insurer’s expert evaluation report on the insured goods drawn up as part of an 
insurance policy claim is personal information of the insured. 


(a) Boucher v. Assurances générales des Caisses Desjardins, [1999] CAI 52. 


Only individuals concerned have an interest in initiating a complaint with respect to 
personal information. 


(a) Bureau danimation et d'information logement du Québec métropolitain v. 
Société immobiliére Jean-Yves Dupont inc., [2000] CAI 103. 


The CAI considered that the “work product” of a professional (such as a pharmacist or a 
physician) should be considered “personal information” related to that professional. 


(a) LMS. du Canada Ltée. v. CAI, J.E. 2002-511 (S.C.). 


Since a corporation may only act through its employees, the name of an employee acting 
as representative of the company is not personal information. 


(a) Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67; 


vi 


(2.2) 


ati 


Debut 
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(b) Leblond vy. Assurances générales des Caisses Desjardins, [2003] CAI 391 
(Appeal granted on questions of professional secrecy J.E. 2004-2148 


(C.Q.)). 
THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9) 
Identification of the object of the file (section 4) 


For example, personal information that may be necessary at the pre-hiring stage of an 


employment relationship may not all be entered into the employee's file once he/she has 
been hired. 


(a) X and Résidence L’Oasis Fort-Saint-Louis, [1995] CAI 367; 
(b) Bayle v. Université Laval, [1992] CAI 240. 
The “necessity” criterion (section 5) 


The burden lies with the person who claims that the information is necessary. 
(a) X. v. Le Groupe Jean Coutu (PJ.C.) Inc., [1995] CAI 128; 
(b) Tremblay v. Caisse Populaire Desjardins de St-Thomas, {2000] CAI 154; 
(c) Julien vy. Domaine Laudance, [2003] CAI 77; 


(Wd) A. v. C., [2003] CAI 534. 


According to the strict approach for the notion of necessity, personal information is often 
categorized as non-necessary. 


(a) Syndicat des employées et employés professionnels et de bureau, section 
locale 57 Caisse populaire St-Stanislas de Montréal, D.T.E. 99T-59 (T.A.); 


(b) X. and Synergic International 1991 inc., [1995] CAI 361; 
(c) X. and Ameublements Tanguay, A.1.E. 95AC-112 (Inquiry Report); 
(d) X. and Boite noire, A.1.E. 96AC-33 (Inquiry Report); 


(e) X. and Ordre des comptables agréés du Québec, A.1.E. 95AC-115 (Inquiry 
Report); 


(f) Comeau v. Bell Mobilité, [2002] CAI 1 (Discontinuance of the motion to 
authorize appeal (C.Q., 2002-05-14); 


Moses v. Caisse populaire Notre-Dame-de-la-Garde, |2002] CAI 4; 


(g) 
(h) St-Pierre v. Demers-Dion, [2002] CAI 83 (Motion to authorize appeal 
granted (C.Q., 2002-10-01), deliberating since 2004-10-06); 


(i) La pratique de vérification de l'identité chez Valeurs Mobiliéres Desjardins, 
CAI # 02 03 76, 02 09 82, 02 09 83 and 02 13 83, March 25, 2003 (Inquiry 
Report). 
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LEARNING FROM A DECADE OF EXPERIENCE: Quebec's Private Sector Privacy Act 
Decisions and interpretations rendered under the ATI Act apply for the purpose of the 
interpretation of the Québec Private Sector Act. 


@) La Personnelle vie, Corporation dAssurance v. Cour du Québec, [1997] CAI 
466 (S.C.). 


According to the broader approach, the criterion of “necessity” pre-supposes an underlying 
purpose to the collection of the information and must be viewed in light of the purposes 
at hand. 


tal Bellerose v. Université de Montréal, [1988] CAI 377 (C.Q.). 
(b) Bayle v. Université Laval, [1992] CAI 240; 


Recently, the Court of Québec developed a method to determine and apply the “necessity” 
criterion similar to the test developed in R. v. Oakes, [1986] 1 S.C.R. 103. 


(a) Laval (Ville de) v. X, [2003] I1JCan 44085 (C.Q.). 

The “necessity” criterion as it relates to “consent” 

The “necessity” criterion cannot be “overridden” by the individual’s consent. 
(a) Laval (Ville de) v. X, [2003] IJCan 44085 (C.Q.). 


(b) Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000], CAI 154 
(Inquiry Report); 


(c) Julien v. Domaine Laudance, [2003] CAI 77; 
(d) A. v. C, [2003] CAI 534); 
(e) Agyemang v. Ipex Inc., [2001] CAI 201. 


The requirement that personal information be collected directly from the person 
concerned, and related exceptions (section 6) 


Except where exceptions apply, the person concerned must be informed and give his or 
her consent where additional information could be sought from third parties. 


(a) X. v. Agence de recouvrement Réjean Aubé inc., A.1.E. 96AC-75 (Inquiry 
Report). 


Generally, before communicating such information, the third party must be authorized 
under sections 13, 14 and 15 of the Québec Private Sector Act. 


(a) X. v. Services aux marchands détaillants Itée, A..E. 96AC-101 (Inquiry 
Report); 


(b) X. v. Banque nationale du Canada, A.1.E. 96AC-103 (Inquiry Report). 
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SUMMARY OF CASE LAW 


The exceptions that allow for the collection of personal information from third parties 
must be interpreted restrictively. 


(a) X. and Banque Royale du Canada, A.1.E. 95AC-72 (Inquiry report). 
For example, collection from a third party may be permitted in order to ensure the accuracy 


of information in matters involving credit offices, financial institutions or insurance 
companies. 


(a) Duchesne v. Great-West (La), compagnie dassurance-vie, [1995] CAI 493. 
(b) Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000] CAI 154. 


The prohibition on refusing to respond to a request for goods or services or to a 
request relating to employment by reason of the applicant's refusal to disclose 
personal information (section 9) 


One example of application arose in the context of personal information being requested 
by a landlord as part of a rental application. 


(a) A. v. C., [2003] CAI 534. 
USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13) 


It is the enterprise’s responsibility to ensure that personal information about an individual 
contained ina file is only used in accordance with the object of the file, or communicated to 
a third party with the informed consent of the individual or with the express authorization 
by the Act. 


(a) X. v. Le Groupe Jean Coutu (PJ.C.) inc., [1995] CAI 128; 
(b) Laval (Ville) v. X., [2003] I1JCan 44085 (C.Q,). 


Should an enterprise err and inappropriately use or communicate personal information, it 
may be held liable for damages. 


(a) Roy v. Société sylvicole dArthabaska-Drummond, J.E. 2005-279 (C.Q.). 


THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26) 


The consent provision 


Validity of consent 


It has generally been held that a person suing for damages or requesting disability 
compensation from an insurance company consents to the disclosure of the relevant 


medical records. 


(a) Bédard v. Robert, J.E. 2003-589 (S.C.). 


(B) 
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Requirements for consent 


The consent form must specifically indicate the purpose for which the information is to be 
obtained. Otherwise, the individual would not be able to make an enlightened decision. 


(a) Service daide au consommateur v. Reliable (La), compagnie dassurance- 
vie, [1996] CAI 406 (Inquiry Report). 


The enterprise that wishes to disclose personal information once the initial transaction is 
completed must give its client the opportunity to give consent. In such a case, the consent 
must be separate, optional and specific. 


(a) X. v. Services aux marchands deétaillants Itée, [1996] CAI 408 (Inquiry 
Report). 


The consent of a union can be equivalent to the consent of the employees. 


(a) Association internationale des machinistes et des travailleuses et travailleurs 
de laérospatiale, section locale 2468 et Rolls-Royce Canada Itée, D.T.E. 
2001T-153 (T.A.). 


Medical reports are not deemed to be information that is necessary for the purpose of an 
“employee file” when they are given for insurance claim purposes only. 


(a) Agyemang v. Ipex Inc., [2001] CAI 201. 


An enterprise cannot go through an intermediary to collect information concerning its 
client’s solvency without informing the latter of the intermediary’s role. 


(a) X. v. Agence de recouvrement Réjean Aubé inc, [1996] CAI 401. 


The expression “financial relations” appearing in a consent form was deemed ambiguous 
and not explicit enough in one case to authorize a financial institution to disclose to the 
plaintiff’s employer the cost of his rent and the amount of support paid. 


(a) X. v. Banque nationale du Canada, [1996] CAI 410. 


A credit card company cannot conduct a semi-annual verification of its credit card holders’ 
records if no consent was obtained during the credit card application process. 


(a) X. v. Sears Canada inc., [1996] CAI 390 (Inquiry Report). 


If a psychiatrist is asked to evaluate a patient, a hospital is not entitled to disclose the 
patient's medical record in its entirety without the latter's prior consent. 


(a) X. v. Hétel-Dieu de Québec, [1996] CAI 400 (Inquiry Report). 


When a document containing personal information is given pursuant to a confidentiality 
undertaking, the document cannot be disclosed to a third party without the consent of the 
person concerned. 


4.1.11 
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4.1.13 


4.1.14 
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SUMMARY OF CASE LAW 


(a) Pouliot v. Biochem Pharma Inc., [1996] R.J.Q. 1845 (S.C.) [reversed by the 
Court of Appeal, [1997] R.J.Q. 1 (C.A.) on the grounds that the Québec 
Private Sector Act did not apply and on other factual grounds]. 


A consent provision can be limited in time when new circumstances arise which lead to 
believe that the consent is no longer applicable. 


(a) Royal & SunAlliance du Canada v. Québec (Ministére de la Sécurité 
publique), A.1.E. 2004AC-71. 


The Supreme Court of Canada ruled that a consent to the disclosure of the relevant medical 


information stemmed from the taking of the judicial proceedings concerning damages to 
the plaintiff's health. 


(a) Frenette v. Metropolitan Life Insurance Co., [1992] 1 S.C.R. 647; 
(b) Glegg v. Smith & Nephew Inc., 2005 SCC 31 (May 20, 2005). 


Privacy legislation will not restrict the judge in civil courts from ordering the disclosure of 
some relevant information concerning the parties in a litigation process. 


(a) Axa assurances inc. v. Gestion dArtagnan inc., REJB 2001-25174 (C.S.); 


(b) Société nationale de lamiante c. Lab Chrysotile inc., [1995] R.J.Q. 757 
(C.A.) (Motion for autorisation to appeal before Supreme Court rejected 
(S.C.C., 1995-09-07)); 


(c) 9083-2957 Québec inc. c. Caisse populaire de Riviére-des-Prairies, }.E. 
2004-2000 (C.A.). 


On the other hand, privacy legislation could serve as support for a party where the 
information sought about them is not clearly relevant or is more of a “fishing expedition” 


(a) Blaikie c. Commission des valeurs mobiliéres du Québec, J.E. 1990-595 
(EAs) 


The exceptions to the consent provision 


Disclosure to authorized employees, mandataries or agents (section 20) 


An employer may not distribute a disciplinary notice to several foremen or employees if 
the information is not needed for the performance of their duties. 


(a) X. v. Komdresco Canada inc., A.LLE. 95AC-114 (Inquiry Report). 


Since paycheck slips contain some personal information that the immediate supervisor 
of the employees does not need to know, the information must be kept and handled in a 
confidential manner. 


(a) Union des employées et employés de service, section locale 800 et For-Net 
inc., D.T.E. 97T-798 (A.T.). 
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4.2.3 A doctor’s employees may access a medical file only for invoicing purposes. 


(a) Y v. Centre hospitalier Hétel-Dieu dAmos, A.1.E. 97AC-93 (Inquiry 
Report). 


4.2.4 It should be noted that a verbal agreement is not sufficient as an appropriate safety 
measure to ensure the confidentiality of the information when agents are involved. When 
an enterprise transfers information to a third party (mandatary or agent), the CAI requires 
that it be accomplished through a written contract containing specific details: 


1) the contract between the enterprise and the mandatary is in writing; 
2) the contract must specify: 
(i) the scope of the mandate; 
(ii) the purposes for which the mandatary (agent) wants to use the information (re: 
the object of the file); 
(iii) the category of individuals who would have access to the information; and 
(iv) the obligation to keep the information confidential. 


(a) X. v. Métropolitaine (La), [1995] A.I.E. 95AC-46 (Inquiry Report). 
(b) Deschesnes v. Groupe Jean Coutu, [2000] CAI 216. 


(B) Disclosure in a context of investigation [section 18(3) and in fine] 


4.2.5 The Superior Court ruled that an investigator employed by the “Insurance Crime 
Protection Bureau” is authorized to communicate to the “Social Security Authority” 


personal information without the consent of the person concerned. 


(a) Charest v. Tribunal administratif du Québec, J.E. 2002-628 (S.C.). 


(C) Disclosure when required or authorized by law or by collective agreement [section 18(4) 
and (6)] 


4.2.6 ‘The consent of a union is equivalent to the consent of the employees. 


(a) Association internationale des machinistes et des travailleuses et travailleurs 
de laérospatiale, section locale 2468 et Rolls-Royce Canada Itée., D.T.E. 
2001 T-153 (T.A.). 


4.2.7 An employee may obtain from his employer the communication of documents needed in 
the dispute of a grievance involving the application of a collective agreement. 


(a) Syndicat des travailleuses et travailleurs de Spectube inc. (ES.S.A.) and 
Spectube inc., D.T.E. 2003T-1049 (A.T.). 
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SUMMARY OF CASE LAW 


Medical reports possessed by an insurer may be communicated to the Régie des rentes 
du Québec without the consent of the applicant because the law grants the power of 
investigation and access. 


(a) Affaires sociales — 387, [2000] T.A.Q. 21 (T.A.Q.). 


Permitting lawyers via subpoena to directly obtain documents from a third party and to 
access personal information that otherwise could not be disclosed without the consent of 
the person concerned would short circuit the judicial process. The information remains 
confidential and can only be communicated on the direction of the court. 


(a) X. and Banque Royale du Canada, A.1.E. 95AC-72 (Inquiry report); 
(b) McCue v. Younes, 2002 I1JCan 30581 (S.C.). 


The Québec Private Sector Act does not constitute, in and of itself, a valid reason to refuse 
the disclosure of a document in legal proceedings. 


(a) 9083-2957 Québec inc. v. Caisse populaire de Riviére-des-Prairies, J.E. 
2004-2000 (C.A.). 


The exception of research purposes and information on professionals (sections 21 


and 21.1) 


4.2.11 


(E) 


4.2.12 


4.2.13 


Since adoption of section 21.1, enterprises that collect prescription information from 
pharmacists in order to compile and analyze prescription practices of physicians, which 
is subsequently sold to pharmaceutical companies for marketing purposes may continue 
their activities. 


(a) I.M.S. du Canada Itée c. Commission dacces a l'information, J.E. 2002-511 
(S.C). 


(b) Décision en regard du rapport pour le traitement d’une demande faite par 
Apaxys Solutions inc. et visée par larticle 21.1 de la Loi sur la protection 
des renseignements personnels dans le Secteur privé, CAI no. 04 17 07, 
March 17th, 2005. 


The exception of nominative lists (sections 22 to 26) 


A person requesting information on classes offered by a school does not become a “client” 
and therefore, his name cannot be put on a nominative list accessible to third parties. 


(a) X. v. Institut de Carriére Universel, A.1.E. 96AC-106. 


The foundation of a hospital being a “private enterprise,’ it must comply with the 
requirement of giving the person an opportunity to have their name removed from a 


nominative list. 


(a) X. v. Hétel-Dieu de St-Jéréme, A.1.E. 97AC-45. 
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Personal information on clients extracted from a pharmacist’s files, other than names and 
addresses, does not fall within the scope of the exception concerning the use or disclosure 
of a nominative list. 


(a) Deschesnes v. Groupe Jean Coutu, [2000] CAI 216. 
ACCESS AND RECTIFICATION PROVISIONS (SECTIONS 27 TO 41) 
The individual's rights of access and rectification 


All administrative notes containing personal information on the person concerned are 
deemed to be part of the “file” and therefore accessible. 


(a) X. v. S.E.M.O. Drummond inc., [1998] CAI 364; 


(b) Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), 
[confirmed by Superior Court: Assurance-vie Desjardins-Laurentienne inc. 
v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08)]. 


The right of access only applies to personal information on the individual concerned. 
(a) X. v. Compagnie Wal-Mart du Canada, A.1.E. 2004AC-85. 


Except where section 36 of the Québec Private Sector Act applies, enterprises may destroy 
personal information without permission or further formality. 


(a) Congrégation des Témoins de Jéhovah D'Issoudun-Sud v. Mailly, J.E. 2000- 
1776 (C.Q). 


Although information contained in someone’s credit report may cause him harm, this is 
not a ground for rectification, when information is accurate. 


(a) X. v. Equifax Canada inc., [1995] CAI 286; 
(b) Hallis v. Equifax Canada inc., [1996] CAI 107; 
(c) Ravinsky v. Equifax Canada inc., [2003] CAI 46. 


In credits files, an accurate inscription may be removed only where authorization is given 
from the creditors who have asked that the inscription be put in the credit file. 


(a) Ohayon v. Trans Union du Canada inc., CAI 01 11 33, June 18", 2002, c. C. 
Constant. 


However, when the information is inaccurate or collected illegally, rectification requests 
will be granted. 


(a) Boisvert Bélisle v. Pharmacie Jean Coutu, CAI 94 16 07, December 7", 
1995, c. M. Laporte; 


(b) X. v. Vision Trust Royal, [1994] CAI 290; 
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(c) Woél v. Nissan Canada Finances inc., [1999] CAI 403. 
Exceptions to the principle of access and rectification (sections 37 to 41) 


As exceptions to the principle of access and rectification, these exemptions should be 
interpreted restrictively. 


(a) X. v. Zurich du Canada, compagnie dassurance-vie, [1995] CAI 119 
(Discontinuance of the appeal (C.Q., 1997-03-20)). 


Serious harm to a person's health (sections 37-38) 


It is appropriate for the enterprise to wait for the individual concerned to designate a 
physician to receive the medical record. The medical situation of the person concerned 
must be assessed at the time the application access is filed, not of the hearing. 


(a) Sicard v. Subak, J.E. 2000-1229 (C.Q.). 


An employer has no right to ask employees why they want to access (or receive a copy of) 
their medical record. 


(a) Olymel, société en commandite (établissement St-Simon) and Syndicat des 
travailleurs d’Olympia (C.S.N.), D.T.E. 99T-497 (A.T.). 


This exception for medical records may be invoked alongside with other exceptions to 
disclosure, such as the one relating to the likelihood of affecting judicial proceedings. 


(a) La Personnelle Vie, Corporation d’Assurance v. Cour du Québec, {1997} 
CAI 466 (S.C.). 


Likelihood of affecting judicial proceedings [subsection 39(2)] 


The Québec Private Sector Act does not require that information that an enterprise wishes 
to protect be generated in the course of a formal dispute resolution process. 


(a) Général Accident Compagnie dAssurance du Canada v. Ferland, {1997} 
CAI 446 (C.Q.). 


It focuses rather on the likelihood that disclosure of the information will affect judicial 
proceedings following the following criteria: 


1) The file contains personal information concerning the person making the request; 


2) The refusal is related to judicial proceedings, although the proceedings need not be filed. 
However, there must be serious indication that proceedings will eventually be filed (for example, a 
formal letter of demand, or an admission made by the person concerned); 


3) The personal information to be disclosed be likely to have an impact (not necessarily decisive) 
on existing or potential judicial proceedings; and 


4) These conditions must have existed at the time the enterprise indicated its refusal to grant 


access. 
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(a) Pichette v. SSQ-Vie, [1995] CAI 4 (Motion to appeal dismissed); 


(b) Personnelle vie, corp. dassurance v. Cour du Québec, [1997] CAI 466 
(S:C2) 


5.2.7. ‘The burden of proof to demonstrate the likelihood that the disclosure may affect judicial 
proceedings lies with the enterprise. 


(a) Bolduc v. Coté, [1994] CAI 219; 
(b) Turgeon v. Company dassurance Bélair, [1995] CAI 11; 
(c) Hermann-Busson v. Service anti-crime des assureurs, [1999] CAI 287. 


5.2.8 The testimony of the person concerned could be considered sufficient to determine his 
or her intention to institute legal proceedings. On the other hand, even if the person 
concerned testifies that he or she has no intention to sue, the sending of a formal letter of 
demand may indicate an intention to the contrary. 


(a) Turgeon v. Companie dassurance Bélair, [1995] CAI 11; 


(b) Assurance-vie Desjardins Laurentienne inc. v. Morin-Gauthier, J.E. 1997- 
1950(C.Q,); 


(c) Général Accident Compagnie dAssurance du Canada v. Ferland, [1997] 
CAI 446 (C.Q)). 


5.2.9 This exception also applies to quasi-judicial proceedings (such as grievance arbitrations). 
(a) Bolduc v. Cété, [1994] CAI 219; 
(b) Rioux v. Recyclage Kebec inc., [2000] CAI 117; 
(c) Papaeconomou v. Pratt & Whitney Canada, {2000} CAI 41. 


(C) Personal information of third parties (section 40) 


5.2.10 The third party protected contemplated in this exception is an individual. 
(a) Lavoie v. Pinkerton du Québec ltée, [1996] CAI 67; 


(b) Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] CAI 
i. 


5.2.11 The tribunal takes it upon itself to protect the third parties in order to avoid that prejudicial 
personal information be disclosed. 


(a) Turgeon v. Compagnie dassurances Bélair, [1995] CAI 11; 


(b) Gravel v. Sécurité (La), assurances générales, [1999] CAI 83 (Appeal granted 
on the question of professional secrecy, (C.Q., 2000-04-12)). 
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The CAI refused to grant access to an individual's file where he could find the name of a 
person who filed a complaint against him, because of the likelihood that the individual 
might take action against the complainant on the basis of the information obtained. 


(a) Harris v. Aéroports de Montréal, [1994] CAI 259. 


The CAI has generally recognized that, under the ATI Act, the name of a complainant is 


considered personal information about a third person where the disclosure may seriously 
harm this third person. 


(a) Larocque v. Repentigny, A.1.E. 2004AC-98; 
(b) Hébert c. Régie de lassurance maladie du Québec, [1994] CAI 136; 
(c) Corp. d’habitations Jeanne-Mance c. Laroche, J.E. 97-1738 (C.Q.). 


The “serious harm” test was met in a case where the person concerned was seeking the 
name of a third party in order to initiate legal proceedings against them. 


(a) XY v. La Capitale assurances générales inc., CAI # 03 04 91, November 13, 
2003, c. H. Grenier. 


Where there is insufficient evidence of actual harm resulting to a third party, the third- 
party exception was set aside and access was granted. 


(a) Nadeau c. Contrevent (Le), [1996] CAI 171. 


It has also been held that the disclosure of personal information about the third party 
already known to the person seeking disclosure cannot constitute serious harm. 


(a) Villeneuve v. Laliberté & Associés inc., [2003] CAI 207; 


(b) Gauthier v. Syndicat des employées et employés de la Bibliothéque de 
Québec, [1997] CAI 1. 


Under federal Acts, the Federal Court of Appeal held that the judge must balance the 
private and public interests at stake when considering a request for access to personal 


information. 


(a) Canada (Information Commissioner) v. Canada (Minister of Citizenship 
and Immigration), 2002 FCA 270. 


The CAI refused to consider personal opinions expressed by a third party as personal 
information about those third parties, when these opinions occurred in the execution of 


the employment of the third party. 


(a) Giroux v. Centre daccueil La Cité des Prairies inc., [1993] CAI 53 (CAI); 


(b) Leroux v. Québec (Ministére de la sécurité publique), [1993] CAI 299 
(CAI). 
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Other exceptions to the applications for access and rectification 


5.2.19 “Public interest” may allow an enterprise to justify a refusal to grant access to an individual’s 


6.0.1 


6.0.2 


6.0.3 


6.0.4 


file. For example, an individual cannot access documents that are protected by professional 
secrecy, even if the information is kept in the individual’s file. 


(a) Jou v. Allstate du Canada, compagnie dassurances, [2003] CAI 640; 


(b) Handfield v. Compagnie dassurance-vie Transamerica du Canada, [1999] 
CAI 4 (Appeal dismissed (C.Q., 2000-02-14), Motion for evocation 
dismissed (S.C., 2000-05-26)). 


RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION (sections 10 to 12) 


Producing a list for every employee containing the names, social insurance numbers and 
amounts paid to every employee to the federal authorities, is contrary to the obligation to 
ensure the confidentiality of personal information. 


(a) X. and Poulin de Courval Cie, A.1.E. 97AC-49 (Inquiry report). 


It is interesting to note that currently, the Québec Private Sector Act does not, per se, allow 
an enterprise to adapt its safeguard measures based on the sensitivity of the information. 
But the CAI considered it in some decisions. 


(a) X. and Y. v. Hépital du Sacré-coeur de Montréal, CAI 98 13 00, July, 16", 
2002, c. C. Constant, J. Stoddart and M. Laporte; 


(b) X. v. Ville de Saint-Laurent, CAI 97 04 78, June 14, 2000, c. P-A. 
Comeau; 


(c) X. v. Centre de protection et de réadaptation de la Céte-Nord, CAI 02 06 
08, July, 24", 2003, c. D. Boissinot; 


(d) X. v. Ministére de la Sécurité Publique, CAI 02 06 20, August 4", 2003, c. 
D. Boissinot. 


One should note that the duty to use accurate and updated personal information does not 
exempt enterprises from collecting consent to update personal information. 


(a) X. v. Sears Canada inc., A.1.E. 96AC-34 (Inquiry Report). 


The case law clearly holds that the information need not be destroyed by enterprises. 
However, enterprises cannot use it any longer, unless the person concerned consents to 
the new usage. 


(a) Equifax Canada inc. v. Fugere, [1998] J.E. 1999-2363 (C.Q.); 
(b) Julien v. Domaine Laudance, (2003] CAI 77; 


(c) Thibault v. Capitale (La), compagnie dassurances générales, [2001] CAI 
78. 
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THE CIVIL LIABILITY OF THE ENTERPRISE AND DAMAGES AWARDED 


A plaintiff asked a bank to cease giving information about her account to her soon-to-be- 
ex-husband. The bank failed to do so. The Court awarded $1,000 in damages. 


(a) Demers v. Banque Nationale du Canada, B.E. 97BE-330 (C.Q.). 


Another plaintiff was excluded from a social club for elderly people. A notice was posted in 
the basement of the church to this effect, also specifying the reason why he was excluded. 
The court awarded $500 for moral damages for the humiliation suffered. 


(a) Chartrand v. Corp. du Club de lamitié de Plaisance, B.E. 97BE-878 
(Co). 


The information held by a credit bureau was not up to date and accurate. Although the 
plaintiff made numerous demands, the file was not rectified. The court awarded $800 in 
general damages and $1,500 in punitive damages. 


(a) Boulerice v. Acrofax inc., [2001] R.L. 621 (C.Q.). 


An employee ofa car dealer used the plaintiff’s personal information, despite his refusal, to 
save taxes for another person. The court awarded $2,000 in lawyer’s fees in order to rectify 
the credit file, $5,000 in moral damages and $5,000 in punitive damages. 


(a) Stacey v. Sauvé Plymouth Chrysler (1991) inc., J.E. 2002-1147 (C.Q.). 


The court ruled that GMAC transferred the information to Equifax and Trans-Union 
without a valid consent. The court did not even consider the veracity of the information 
communicated and awarded $500 in damages. 


(a) Basque v. GMAC Location Limitée, 2002 UJCan 36125 (C.Q.). 


Another enterprise disclosed confidential personal information and this constitutes a 
fault that engages liability. The court awarded $2,500 in moral damages, $2,000 in punitive 
damages and $1,000 for trouble and inconveniences. 


(a) Roy v. Société sylvicole dArthabaska-Drummond, J.E. 2005-279 (C.Q.). 


SPECIAL QUEBEC LEGISLATIVE RULES GOVERNING THE COLLECTION, USE AND 
DISCLOSURE OF PERSONAL HEALTH INFORMATION 


Initially, the Québec Private Sector Act was not interpreted as creating any obstacles for 
employees seeking to access their personal health information. 


(a) Adam v. Gauthier, [1997] CAI 18; 


(b) De Bellefeuille v. Clinique Médiavis inc., [1999] CAI 1. 


The CAI ina recent case agreed to apply the “impact on judicial proceedings” exception of 
subsection 39 (2) as ground for refusing access. 


(a) Papaeconomou v. Pratt & Whitney Canada, [2000] CAI 41. 
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In the context of labour relations, the CAI recognized that more generous legislation 
should take precedence over the Québec Private Sector Act’s more restrictive exceptions 
to access. 


(a) Malenfant v. Caisse populaire Desjardins de LAncienne-Lorette, [1996] 
CAI 218. 


According to section 19 of the Act respecting health services and social services, personal 
health information of another user is confidential, can only be accessed with that user’s 
consent or on a court order. 


(a) X. v. Centre hospitalier de 'Université de Montréal, [2003] CAI 524. 


The Professional Code was amended in order to allow professionals to disclose information 
“in order to prevent an act of violence, including a suicide, where he has reasonable cause to 
believe that there is an imminent danger of death or serious bodily injury to a person or an 
identifiable group of persons.” 


(a) Smith v. Jones, [1999] 1 R.C.S. 455. 
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INTRODUCTION 


n 1993, the Québec National Assembly adopted a statute entitled An Act respecting the protection 

of personal information in the private sector, R.S.Q., c.P-39.1 (the “Québec Private Sector Act”), 

which came fully into force in 1994. Since then, various courts or tribunals in the province of 
Québec have had the occasion to interpret and apply many of its provisions. 


The Personal Information Protection and Electronic Documents Act ( “PIPEDA”), enacted in 2000, 
took full force and effect in January 2004. These two pieces of legislation, the Québec Private 
Sector Act and PIPEDA, stem from the same rationale and are based on similar principles aimed 
at protecting personal information collected, used or disclosed by an organization (an “enterprise” 
under the Québec Private Sector Act) in the course of its operations (“commercial activities” under 
PIPEDA). 


Hence, gaining a better understanding of the jurisprudence that has interpreted the Québec Private 
Sector Act can prove to be useful for interpreting similar principles contained in PIPEDA, to the 
extent that may be relevant and applicable to both Acts. 


The following courts and tribunals have issued decisions that interpret and apply the Québec 
Private Sector Act: 


Commission d’accés a linformation (CAI): This administrative tribunal was created under 
the Québec statute entitled An Act respecting access to documents held by public bodies and the 
protection of personal information, R.S.Q., c. A-2.1 (the “ATI Act”) and is now vested with the 
necessary powers to administer the Québec Private Sector Act. The Commission is composed 
of five (5) commissioners and has two types of powers. Firstly, it is vested with the power to 
examine and decide a dispute relating to a legislative provision concerning access or rectification 
of personal information. This dispute resolution power can be exercised by a single commissioner. 
Secondly, the CAI has the power to conduct inquiries into any matter relating to the collection, 
retention, use or communication of personal information. This power of inquiry must be exercised 
by the Commission composed of three (3) of the five (5) commissioners.’ Following an inquiry, 


1 Now pending before the Québec National Assembly, Bill 86 proposes to allow one commissioner to act in inquiry 
matters. Two processes have been used by the Commission to exercise its power of inquiry. The Commission may 
“hear” the parties concerned or the complaint received before issuing its ruling containing its recommendations and 
remedial measures, when need be. Or an investigator is appointed, who will collect and review the relevant facts (in 
light of the complaint received), will prepare a preliminary report to be addressed to the Commission, which will seek 
to obtain from the parties their comments and representations on the report, in order to allow the preparation of a 
“final” report for the Commission's consideration. 
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the Commission may recommend or order the application of appropriate remedial measures to 
ensure the protection of the personal information. The reader should take note that there may be 
“variations” in the decisions or rulings issued by the commissioners, since no commissioner is 
bound, legally or practically, to follow a precedent set by another commissioner. 


The Court of Québec (C.Q.): This provincial court is the “Appellate Court” of all final decisions 
rendered by the CAI under the Québec Private Sector Act that raise a question of law or jurisdiction. 
No appeal may be brought except with leave from a judge of the Court of Québec. The motion for 
leave to appeal must specify the questions of law or jurisdiction which ought to be examined in 
appeal.’ 


Superior Court (S.C.): This is the tribunal of inherent jurisdiction (under Section 96 of the 
Constitutional Act of 1867) where judicial revisions are filed and decided. 


Court of Appeal of Québec (C.A.): This is the highest court of the province, where decisions 
rendered by the Superior Court or by the Court of Québec are appealed. 


Some references are also made to decisions rendered by other tribunals that may have interpreted 
and applied the Québec Private Sector Act, such as the Administrative Tribunal of Québec 
(T.A.Q.) and Labour Arbitrators (T.A.). . 


The provisions dealing with the protection of personal information are part of a larger “ensemble” 
of legislation adopted by the province of Québec. Privacy is a much broader concept than the 
protection of personal information. This explains why courts and tribunals of Québec often 
refer not only to the Québec Private Sector Act or the ATI Act, but also to the Civil Code of 
Québec (C.C.Q.), the Code of Civil Procedure (C.C.P.), the Québec Charter of Human Rights and 
Freedoms, R.S.Q., c. C-12 (the “Québec Charter”) and to the Act to Establish a Legal Framework 
for Information Technology, R.S.Q. c. C-1.1. 


This being said, however, the Québec Private Sector Act is the specific law that was adopted by the 
Quebec National Assembly to establish particular rules for the handling of personal information 
in the private sector. It is important to read the Québec Private Sector Act in light of its main 
“pith and substance’, that is, to canvass the enterprises’ obligations with respect to the handling of 
records containing personal information in order to afford individuals with the right to protection 
of — and access to — their personal information which is collected, held, used or communicated by 
another person in the course of carrying on an enterprise. 


The present document is mainly a summary of relevant decisions rendered by the Commission 
dacces a l'information under the Québec Private Sector Act, though some references to decisions 
of other tribunals interpreting the same Act are also included. 


* Bill 86 proposes abolishing the requirement to obtain leave to appear the final decisions of the CAI However Bill 


86 proposes to extend this right to appeal with leave from a judge of the Court of Québec, against the interlocutory 
decisions which cannot be remedied by the final decision. 
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THE SCOPE OF APPLICATION 
OF THE QUEBEC PRIVATE*SEGTOR AGE 


he rationale and principles underlying the Québec Private Sector Act are quite similar to 
those of PIPEDA. The first section of the Québec Private Sector Act defines the object of the 
Act and its scope of application: 


1. The object of this Act is to establish, for the exercise of the 
rights conferred by articles 35 to 40 of the Civil Code of Québec 
concerning the protection of personal information, particular rules 
with respect to personal information relating to other persons 
which a person collects, holds, uses or communicates to third 
persons in the course of carrying on an enterprise within the 
meaning of article 1525 of the Civil Code of Québec. (our 
emphasis). 


The Court of Québec summarized the Québec Private Sector Act with these four principles: 


1. A person or a corporation must have a serious and legitimate reason for establishing a 
file on someone; 


2. Every individual has the right to access his or her file, unless the rights of third parties 
must be protected or there is a serious reason for refusing access; 


3. Every individual has the right to rectify an incorrect, incomplete or obsolete file; and 


4. Every person or corporation that opens a file on an individual has an obligation of 
confidentiality.’ 


The Québec Private Sector Act does not specifically grant exclusive jurisdiction to the CAI to hear 
and decide any dispute arising from the application of the Act. But the Superior Court has decided 
that aside from its jurisdiction to rule on any request of application of the Code of Civil Procedure 
(in the course of a litigation), the CAI has exclusive jurisdiction to hear and decide “introductory” 


3 Institut dassurance du Canada v. Guay, J.E. 1998-141 (C.Q.). 
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request for access to an individual's record, when an enterprise is involved‘. Therefore, in principle, 
the CAI has jurisdiction over any matter relating to requests for access or rectification of personal 
information, as well as any matter dealing with the collection, retention, use or disclosure of 
personal information. This does not bar other administrative tribunals or courts from considering 
the Québec Private Sector Act when exercising their duty to hear and decide questions related 
to the protection of personal information. This jurisdiction may even be exclusive®. Moreover, 
the civil courts have been recognized as having the necessary jurisdiction to award damages for 
improper use of personal information’. 


(1.1) Precedence of Québec Private Sector Act over other Québec statutes (section 94) 


Section 94 has the effect of giving the Québec Private Sector Act precedence over other 
statutes, unless expressly provided otherwise. Note that the wording of this section is similar to 
the “Notwithstanding” clause in section 52 of the Québec Charter (similar to section 33 of the 
Canadian Charter), which has the effect of conferring great importance to this Act. Practically 
speaking, unless expressly provided otherwise by another statute, the wording of section 94 
establishes a “minimum” level of protection for an individual’s personal information and right of 
access thereto. If a “higher threshold” of protection or right of access is granted by another statute, 
through “practice’, or otherwise, this higher threshold should be recognized. 


According to professor René Laperriére’, there is substantial case law in support of the proposition 
that the Québec Private Sector Act is a comprehensive scheme for the private sector and provides 
the totality of grounds that an enterprise can raise to refuse to give access to information (section 37 
to 41).° This commentary was used to justify the position that the general provision at article 39 
C.C.Q. (the requirement not to deny access without a serious and legitimate ground) cannot be 
invoked by itself to justify a refusal if no specific grounds are provided to that effect in sections 37 
to 41 of the Québec Private Sector Act. The general theory of abuse of right, enshrined at article 7 
C.C.Q., is not, in and of itself, sufficient ground to refuse access either.? Although the Civil Code 
of Québec contains general provisions on protection and access, the very purpose of the Québec 
Private Sector Act, as provided by section 1 of that Act, is to establish more particular rules for 
exercising those general rights conferred by the C.C.Q. where an enterprise of the private sector 
is involved."® 


Beside those grounds expressly set out in the Québec Private Sector Act, only public interest 
can be raised by a person carrying on an enterprise as an exception to the protection and access 


Monette v. Westbury Canadienne, compagnie dassurance-vie, [1999] CAI 550 (S.C.); Therien v. News Marketing 
Canada, J.E. 2001-809 (S.C.). 


> For example, see CAI v. Hydro-Québec, [2003] CAI 731 (C.A.). To the same effect, see LEcuyer v. Aéroports de 
Montréal, [2003] CFPI 573. 


See chapter 7 — The liability of the enterprise and damages awarded. 


LAPERRIERE, René, La Loi sur la protection des renseignements personnels dans le secteur privé (L.Q. 1993, 
chapitre 17): commentaire et guide d’interprétation, in COTE, René, Vie privée sous surveillance: la protection des 
renseignements personnels en droit québécois et comparé, Cowansville: Editions Yvon Blais, 1994, p.141, 209 


See paragraph 5.2 - Exceptions to the principle of access and rectification (sections 37 to 41) 


° Boyer v. Société des Casinos du Québec inc., [1997] CAI 345. 
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obligations under the Act." For example, the right to professional secrecy enshrined at section 9 of 
the Québec Charter could successfully be raised to prevent access to personal information. Because 


of its “quasi-constitutional” nature, the right to professional secrecy actually takes precedence over 
privacy legislation.” 


We remind you that the Courts generally recognize that the CAI has exclusive jurisdiction to deal 
with matters originating under the Québec Private Sector Act at first instance when an enterprise is 
involved. For example, an originating motion cannot be brought before the Superior Court to access 
one’s personal information contained ina file held by a private-sector enterprise; if a introductory 
demand is purely a request to access information, it falls within the exclusive jurisdiction of the 
CAI” Even if some conclusions for damages are annexed to what is essentially a demand to rectify 
a file, the CAI retains its jurisdiction.'t However, a tribunal may retain exclusive jurisdiction over 
an access or rectification dispute where such arises within the scope of the exclusive jurisdiction 
attributed to the tribunal”. 


Generally speaking, the Québec Private Sector Act cannot be used to refuse to give access to 
documents in the course of legal proceedings.’® 


(1.2) Whatis an “enterprise” under the Québec Private Sector Act? 


One crucial notion concerning the scope of application of the Québec Private Sector Act is the 
definition of “enterprise,” which can be found at article 1525 (3) C.C.Q.: 


The carrying on by one or more persons of an organized economic 
activity, whether or not it is commercial in nature, consisting of 
producing, administering or alienating property, or providing a 
service, constitutes the carrying on of an enterprise. 


This definition of “enterprise” is broader than the definition of “commercial activity” previously 
found under the Civil Code of Lower Canada (replaced by the C.C.Q.). An enterprise does not 
have to carry on activities that are “commercial in nature.” Therefore, the definition may include 
non-profit organizations, professionals, artisans or agricultural activities. 


" Morin-Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal granted on the application of s. 39(2) J.E. 1997- 
1950 (C.Q.)); X. v. Les Services de Santé du Québec, [1994] CAI 263; Duchesne v. Minerais Lac Ltée — La Mine 
Doyon, [1997] CAI 214 (Motion to appeal granted (C.Q., 1997-10-15), Discontinuance of appeal (C.Q., 1998-04-14)); 
Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, , J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11- 
08); Chainé v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27)) and Chainé v. Paul Revere, Compagnie 
dassurance-vie, [1998] CAI 139 (Appeal rejected (C.Q., 2000-04-27)) 


12 Général Accident Compagnie d’Assurance du Canada v. Ferland, [1997] CAI 446 (Q.C.). 


13 Therien v. News Marketing Canada, ).E. 2001-809 (S.C.). See also, Grenier v. Equifax Canada Inc., 2003 WJCan 19492 
(S.C.), where it was held that the Commission is the only tribunal of competent jurisdiction to address the question 
of accessing and rectifying the credit files of minors and individuals of legal age. Monette v. Westbury Canadienne, 
compagnie dassurance-vie, [1999] CAI 550 (S.C.) 


4 Fernandez v. Takhar Financial, 2003 I1JCan 3252 (C.Q.). 


‘Ss For example, see CA/ v. Hydro-Québec, [2003] CAI 731 (C.A.). To the same effect, see L’Ecuyer v. Aéroports de 
Montréal, [2003] CFP1 573. 


16 9083-2957 Québec inc. v. Caisse populaire de Riviére-des-Prairies, }.E. 2004-2000 (C.A.). 
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The new concept of “carrying on an enterprise” appears to reject the two theories of the former 
notion of “commercial activity”” in favour of a new, broader definition. These two earlier theories 


were: 


- The subjective theory, which held that the commercial nature of an activity depends 
on the qualification of the person carrying out the activity, not of the activity itself. This 
theory was very narrow in its application and led to much speculation in its application. In 
order to qualify the person so as to determine whether the activity is “commercial’, must 
one look only at the person’s normal range of activities; 


- The objective theory aimed to qualify the activity itself as commercial. This might seem 
simple, but gave rise to much litigation, leading to a vicious cycle where, in order to qualify 
the nature of a specific activity, one was forced to examine the general activities of the 
person to determine whether they were commercial in nature. 


In principle, the definition of “enterprise” should be understood in the context of the legal field 
in which it applies. There could be as many potential definitions of “enterprise” as there are legal 
fields where such definitions can be applied. In the context of privacy legislation, the definition of 
“enterprise” should benefit from a wide and liberal interpretation in order to allow the legislation 
to achieve its objects of protecting personal information. In a recent decision by the Court of 
Québec, Conseil de presse du Québec v. Lamoureux-Gaboury,'* the Court of Québec concluded 
that there are four elements that can be considered in the definition of an “enterprise”: 


a) that the operations of an enterprise constitute juridical acts, which are repetitive; 
b) that there exists a coordination between human and material resources; 

c) that the organization must aim at responding and satisfying certain needs; and 

d) that its success is dependent on similar standards as to market forces and the 


efforts deployed by the business person. 


When determining if an organization is an enterprise, the main activity must be considered, not 
its ancillary activities.” 


When practicing in a private clinic, a psychiatrist is carrying on an enterprise,” as is any other 
professional who engages in an organized economic activity under the Professional Code, R.S.Q., 
chapter C-26.”1 The Québec Private Sector Act does not per se make a difference between different 
types of “enterprises”, be they conducted by “professionals” or by “typical” merchants. 


N 


BOHEMIER, Albert and COTE, Pierre-Paul, Droit commercial général, 3° éd., t. 1, Montréal, Edition Thémis, 1985, 
p. 20 to 23. 


2003 HJCan 33002 (C.Q.). This decision was overruled by the Superior Court mainly on questions of fact; see Conseil 
de presse du Québec v. Cour du Québec, B.E. 2004BE-651 (motion for leave to appeal granted by the Court of Appeal, 
C.A., 2004-10-07). For a review of this decision, see REYNOLDS, S., Commentaires sur la décision Conseil de presse 
du Québec c. Lamoureux-Gaboury — La notion dentreprise dans le cadre de la Loi sur la protection des renseignements 
personnels dans le secteur privé, Repéres, August 2003, EYB2003REP19. 


' Congrégation des Témoins de Jéhovah D'Issoudun-Sud v. Mailly, J.E. 2000-1776 (C.Q.). 
20 Adam v. Gauthier, [1997] CAI 18. 
1 Québec (Sous-ministre du revenu) v. Lasalle, J.E. 97-1575 (C.Q,). 
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Unions are persons carrying on an enterprise (within an enterprise) because they deliver services, 
represent their members and collect contributions, in this case “union dues” 


Jehovah Witnesses are not carrying on an enterprise because their purpose is spiritual, not 
economic.” This exception is somewhat surprising and does not fit with the test explained above. 


Other religions, like Roman Catholicism, are not subject to the legislation when ruling on religious 
matters concerning relations between individuals and religious authorities (religious tribunal), 
because religious institutions are not carrying on an enterprise. In this context, the Commission 
gave precedence to the fundamental right of freedom of religion over privacy rights.”* 


Information specifically generated or obtained in the context of the execution of a settlement 
in a class action is not subject to the application of this legislation, because such litigation (by 
an enterprise) is not part of the carrying on an enterprise.” However, actions taken by a law 
firm's litigation department to get a bill of costs paid have been qualified as the carrying on of an 
enterprise.” 


The Québec Private Sector Act applies not only to Québec-based enterprises, but to every 
enterprise that conducts business in Québec, independently of the location of its place of business 
and the place where the personal information is stored.”’ 


Section 96 of the Québec Private Sector Act also provides for the application of the Act to 
associations or partnerships carrying on an enterprise. 


The Québec Private Sector Act does not apply to a public body already covered under the ATI Act 
(section 3). 


A recent judgment rendered by the Superior Court determined that the Québec Private Sector Act 
does not apply to some aspects of a “federal undertaking,” such as personal information held on job 
candidates, because both labour relations and conditions of employment are part of the operations 
of a federal undertaking within the sole jurisdiction of the Federal Parliament.” This Superior 
Court decision overturns case law of the CAI, which has ruled several times before in favour of the 
application of Québec Private Sector Act to federal undertakings.” 


2 Gauthier v. Syndicat des employés de la Bibliotheque de Québec, [1997] CAI 1 and Beaudoin v. Syndicat canadien 
des communications, de lénergie et du papier (S.C.E.P.), section locale $30, [2001] CAI 188 (Motion to appeal granted 
(2001-05-15 (C.Q.) and then reversed (2001-10-18 C.Q.)). 


i) 
o 


Bonneville v. Congrégation des Témoins de Jéhovah Valleyfield-Bellerive and Procureur général du Québec, {1995} CAI 
280 and Congrégation des Témoins de Jéhovah D’Issoudun-Sud v. Mailly, }.E. 2000-1776 (C.Q.). 


2+ Rochette v. Tribunal Ecclésiastique de Québec, A.1.E. 2004AC-2 (CAI). 

28 Scarola v. Shell Canada Ltée, 2004 UJCan 41420 (S.C.). 

26 Reeves v. Fasken Martineau DuMoulin, [2001] CAI 322. 

2” Institut dassurance du Canada v. Guay, J.E. 1998-141 (C.Q.). 

28 Air Canada v. Constant, 2003 IlJCan 1018 (S.C.) (Pending in Appeal, 2003-10-02). 


2 Pierre v. Fédéral Express Canada Itée, [2003] CAI 139; Lamarre v. Banque Laurentienne, CAI # 99 09 63, AZ- 
50144774, 2002-08-21, D. Boissinot, M. Laporte, J. Stoddart; Rioux v. Recyclage Kebec inc., (2000) CAI 117; Jabre v. 
Middle East Airlines-AirLiban S.A.L., [1998] CAI 404; DeBellefeuille v. Canpar Transport ltée, [1998] CAI 178 and 
Laperriére v. Air Canada, |1997] CAI 167, Revision granted on other grounds (S.C., 1997-10-08) Appeal dismissed 


(C.A., 2000-04-20). 
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(1.3) The particular situation of Professional Orders (known in other jurisdictions as 
Professional Regulatory Boards) 


Professional Orders are at the heart of one of the lingering debates over the application of the 
Québec Private Sector Act. It is still not clear whether professional Orders are carrying on an 
enterprise (or not) within the current meaning of the Act. 


Summarily, professional Orders are created by statutes. They regroup the professionals concerned 
(ex: lawyers, physicians, accountants, engineers, etc.) among various “professional Orders’, which 
primary mission is the protection of the public. To accomplish its mission the Order is granted 
some powers and duties. Among these powers are included the following: 


a) Professional inspection, the purpose of which is to maintain the standard of 
knowledge and service by the members; 


b) Professional discipline, to maintain a high degree of ethical behavior and conduct 
by the members. The role of “investigator” and “prosecutor” is attributed to the 
“syndic” of the Order; 


c) Adoption of various types of regulations to set the parameters of the professional 
practice (for example, the Code of Ethics). 


When the CAI was first asked to determine whether (or not) a professional Order is an enterprise, 
it decided that the specific activities of the “syndic” do not constitute the carrying on of an 
enterprise because they are, by their very nature, conducted as a public service, and therefore 
cannot be construed as an organized economic activity. The latter element forms a requisite part 
of the definition of “enterprise” under article 1525 C.C.Q. The CAI ruled out the application of 
the notion of enterprise because of the aspect of “public interest” of the activities of professional 
Orders. The tribunal took no position on their other activities (like the services to the members or 
to the public, continuing education, etc.).*° 


Without performing an in-depth analysis of the question, the CAI concluded in an inquiry report 
that the Order of Chartered Accountants was carrying on an enterprise. Note that it was the 
services of the Order to its members that were examined in this case.” 


In December 1995, the Commission decided that professional Orders are not subject to the ATI 
Act, and are therefore governed by the Québec Private Sector Act, making no further comment on 
the matter. This case dealt with admission exams of the members to the Order.” 


In November 1996, the Court of Québec decided that the Insurance Brokers Association of Québec, 
a body similar to a professional Order, was carrying on an enterprise because the exchange of 
services constituted an organized economic activity. ** This conclusion was arrived at despite the 
fact that the activities concerned were similar to those carried on by the syndic of a professional 


°° Whitehouse v. Ordre des pharmaciens du Québec, [1995] CAI 252 and X. v. Corp. professionnelle des médecins du 
Québec, [1995] CAI 245. 

*! Xv. Ordre des comptables agréés du Québec, A.1.E. 95AC-115 (Inquiry Report). 

* Pineault v. Ordre des Technologues en radiologie du Québec, [1996] CAI 7. 

°° Girard v. Association des courtiers dassurance du Québec, [1997] R.J.Q. 206 (C.Q.). 
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Order, clearly rejecting the decision of Whitehouse v. Ordre des pharmaciens du Québec.™* 


In December 1996, the Superior Court went one step further and expanded its reasoning. While 
professional Order qualify as persons carrying on an enterprise, they are excluded from the 
application of the Québec Private Sector Act because they perform a public service and are thus 
not part of “the private sector” governed by the Act.*° Because the legislator did not expressly state 
that the Québec Private Sector Act applies, it does not. This decision may stand for the proposition 
that all functions of professional Orders are excluded from the scope of this legislation. 


In 2002, the Commission took the position once again that professional Orders are not subject to 
the application of the ATI Act” (because not being a “public body”). 


Since professional Orders appear not to be subjected to the Québec Private Sector Act, files may 
only be accessed by filing a motion before the Superior Court under articles 38 and 40 C.C.Q.* 


Because of the substantial debate on this matter, the Court of Québec granted a motion for leave to 
appeal on the application of the Québec Private Sector Act to an association of real estate agents, 
which the CAI had previously determined do not carry on an enterprise.*? However, the appeal 
was dismissed and the judge did not really address the question. The Court stated that the decision 
under appeal did not appear unreasonable.” 


Many of these issues may become moot if Bill 86 is adopted as now suggested. Bill 86 proposes 
that a hybrid regime apply to professional Orders. Firstly, professional Orders would be subject 
to the ATI Act with respect to documents they hold for the purposes of supervising the practice 
of the profession. This would specifically apply to documents concerning professional training, 
admissions, the issue of permits, specialists’ certificates, special authorizations, discipline, 
conciliation, arbitration of accounts, supervision of the practice of the profession, use of a title, 
professional inspection and indemnification, as well as to documents concerning the adoption of 
standards relating to those matters. The Québec Private Sector Act would then also apply only to 
personal information held by professional Orders, other than for the purposes of supervising the 
practice of the profession. 


(1.4) The definition of personal information 
“Personal Information” is defined as follows in the Québec Private Sector Act: 


2. Personal information is any information which relates to a 
natural person and allows that person to be identified. 


4 [1995] CAI 252. 


5 Paraphrased from the summary of this decision rendered by Justice Borduas in Conseil de presse du Québec v. 
Lamoureux-Gaboury, 2003 IJCan 33002 (EQ). 


© Dupré v. Comeau, J.E. 1997-239 San 

” Fabrikant v. Collége des médecins, {2002} CAI 320. 

8 Farhat v. Lalonde, [1999] CAI 544. 

% Tannenbaum v. Assoc. des courtiers et agents immobilier du Québec, 2004 IJCan 29928 (C.Q.). 


© Tannenbaum v. Association des courtiers et agents immobiliers du Québec, 2005 HJCan 15048 (C.Q.). 
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Only information relating to natural persons, in their capacity as individuals, is protected under 
the Québec Private Sector Act.*' It does not apply to information about corporations. 


The notes of an attorney are accessible to his own client when the information contained therein 
relates to a natural person and allows him to be identified.” All the notes that can relate to the 
identification of an individual are considered personal information.” 


After some hesitation, the CAI adopted a broader definition of personal information to include the 
insurer’s expert evaluation report on the insured goods drawn up as part of an insurance policy 
claim, on the basis that information is personal information of the insured.” 


Since only information on individuals is subject to the legislation, only individuals have an interest 
in initiating a complaint with respect to personal information concerning them directly. 


Unlike PIPEDA, the Québec Private Sector Act does not expressly exclude from the scope of 
its definition information relating to “professional/employment status” (such as an individual’s 
name, title or business address or telephone number at work). And unlike the IMS ruling under 
PIPEDA*, the CAI considered that the “work product” of a professional (such as a pharmacist or 
a physician) should be considered “personal information” relating to that professional.” It took an 
amendment (in 2001) to the Act (see section 21.1) to allow the communication to third parties of 
“work product” information. For example, in March 2005 (File No. 04 17 07)*, the CAI granted 
to an enterprise, under section 21.1 of the Act, the authorization to receive communication from 
pharmacists of some personal information on prescription drugs. The CAI specifically underlined 
that information on the “Pharmacy (Identification) Number” , its Postal Code, the dates of the 
transactions, the costs of a drug and the mode of payment are personal information on the activities 
of the pharmacy owners. 


However, some CAI decisions appear to exclude from the definition of “personal information” 
some information about an employee when acting as a representative of a corporation. Since a 
corporation may only act through its employees, the name of an employee acting as representative 
of the company is not personal information.*? The same approach was adopted by the CAI in 


“Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67; Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, ).E. 


1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08); Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, [2002] 
CAI 316. 
” Hudon v. Desrosiers, [1996] CAI 189. 
‘8 Assurance-vie Desjardins Laurentienne inc. v. Stébenne, J.E. 97-1951 (C.Q.), confirmed by Superior Court: Assurance- 
vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08). 
Boucher v. Assurances générales des Caisses Desjardins, [1999] CAI 52. 
45 


Bureau danimation et d'information logement du Québec métropolitain v. Société immobiliére Jean-Yves Dupont inc., 
[2000] CAI 103. 


PIPEDA Case Summary #15, http://www.privcom.gc.ca/media/an/wn_011002_e.asp. 


“” See the Superior Court’s judgment in 1.M.S. du Canada Ltée. v. CAI, J.E. 2002-511, and the reasons of the decision 
rendered by the CAI, as referred to at paragraphs 2 to 6 and 11 to 13. 

** Décision en regard du rapport pour le traitement d’une demande faite par Apaxys Solutions inc. et visée par larticle 

21.1 de la Loi sur la protection des renseignements personnels dans le Secteur privé/, available online on the CAI 

website (http://www.cai.gouv.qc.ca/). 


* Lavoie v. Pinkerton du Québec Ltée, [1996] CAI 67. 
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1 THE SCOPE OF APPLICATION OF THE QUEBEC PRIVATE SECTOR ACT 


Leblond v. Assurances générales des Caisses Desjardins®, where the CAI stated that the name of 
employees who act on behalf of a corporation, their title or functions, their address and phone 
number at work, as well as their written notes and signatures should not be considered “personal 
information” The CAI concluded by stating however that, should these employees be acting in 
their “personal capacity’, their identity and their other personal information should be protected. 


Finally, the Québec Private Sector Act does not include a specific exemption for personal information 
that may be otherwise publicly available. Bill 86 proposes excluding personal information that 
is made public by law from the application of Divisions II (sections 4-9: Collection of Personal 
Information) and III (sections 10-26: Confidentiality of Personal Information) of the Québec 
Private Sector Act. 


%® [2003] CAI 391 (Appeal granted on questions of professional secrecy J.E. 2004-2148 (C.Q.)). 
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2 


ie COME ECG Nie 
PERSONAL INFORMATION 
(SECTIONS 47T0O'9) 


(2.1) Identification of the object of the file (section 4) 


Under the Québec Private Sector Act, a person carrying on an enterprise must have a serious and 
legitimate reason for establishing a file on another person. When establishing that file, the person 
must state its purposes (i.e., the purposes for which the file is established). This entry forms part 
of the file (section 4). 


To date, the case law does not specify the criteria to be applied when determining whether a reason 
is “serious and legitimate.” In fact, the CAI focuses mainly on the criterion of “necessity.’ Under 
section 5 of the Québec Private Sector Act, any person who wants to collect personal information 
to establish a file on another person or record personal information in such a file may only collect 
the information necessary for the object of the file (as defined and documented in the file). 


For example, the CAI decided that personal information that may be necessary at the pre-hiring 
stage of an employment relationship may not all be entered into the employee’s file once he/she 
has been hired. The application record and the employee’s file are two different things, existing for 
two different purposes.°? 


(2.2) The“necessity” criterion (section 5) 


The establishment of objective criteria to define the meaning of “necessary” under the Québec 
Private Sector Act still appears to be unsettled law. At times, the CAI and the courts have adopted 
a very restrictive approach. At other times, both have preferred to adopt a more contextual 
approach. The following examples illustrate the difficulty encountered by the CAI and the courts 
in establishing the specific criteria to be applied in the definition of “necessity/necessary.’ 


*! See, for example, X and Résidence L’Oasis Fort-Saint-Louis, [1995] CAI 367. By analogy, see also Bayle v. Université 
Laval, {1992} CAI 240. 
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2 THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9) 


It has generally been acknowledged that the burden lies with the person who claims that a piece of 
information is necessary.” 


As per one approach, some CAI decisions apply the very narrow definition of “necessity” set out in 
Rédaction et interprétation des lois, where former Justice Louis-Philippe Pigeon underscores that 
“necessary” means “absolutely indispensable” (“absolument indispensable”/“nécessité inéluctable’”). 
According to these decisions, this strict definition must be adopted in order to accomplish the 
goals of privacy legislation. The protection of personal information is a fundamental value that 
requires adopting a very strict and literal definition: essential, indispensable or primordial. 


According to this approach, absent any reasonable basis to doubt its truthfulness, an indication 
that an employee is sick justifies his absence, without having to provide a medical diagnosis.™ 
Moreover, in filling a part of an insurance coverage claim, an employer does not need to know, 
unless an employer is in charge of managing disability claims, the exact diagnosis of an employee 
absent from his employment. The physician's statement of the employee's disability (and applicable 
period) should be sufficient.® If the information is not “absolutely indispensable” for the object of 
the file, like a social security number or the name of a close relation, it is not considered necessary 
and cannot be collected or requested.” In fact, the social security number and driver’s license of 
individuals can only be used for the specific purposes for which they were originally intended, and 
cannot be requested for other purposes, such as general identification purposes.” 


As per a second approach, some decisions of the CAI and the courts examine the factual context 
in which the question of “necessity” arises. Most of these decisions where rendered under the ATI 
Act, which bears a similar requirement that public bodies not collect personal information that is 
not necessary for the carrying out of the mandate of the body or the implementation of a program 
under its management (section 64 of the ATI Act). 


According to this second approach, the criterion of “necessity” pre-supposes an underlying 
purpose to the collection of the information and must be viewed in light of the purposes at hand. 
For example, in the employment context, an employee’s residential phone number was considered 


52 X. v. Le Groupe Jean Coutu (PJ.C.) Inc., [1995] CAI 128; Tremblay v. Caisse Populaire Desjardins de St-Thomas, [2000] 
CAI 154; Julien v. Domaine Laudance, [2003] CAI 77 and A. v. C., [2003] CAI 534. 


3 Collection Etudes juridiques, Editeur officiel du Québec, 1978, at page 15. 


Syndicat des employées et employés professionnels et de bureau, section locale 57 and Caisse populaire St-Stanislas de 
Montréal, D.T.E. 99T-59 (T.A.). 


55 X, and Synergic International 1991 inc., [1995] CAI 361. 


5% X. and Ameublements Tanguay, A.1.E. 95AC-112 (Inquiry Report) and X. and Boite noire, A.1.E. 96AC-33 (Inquiry 
Report) and X. and Ordre des comptables agréés du Québec, A.1.E. 95AC-115 (Inquiry Report). 


5? Comeau v. Bell Mobilité, [2002] CAI 1 (Discontinuance of the motion to authorize appeal (C.Q., 2002-05-14); Moses 
v. Caisse populaire Notre-Dame-de-la-Garde, [2002] CAI 4; St-Pierre v. Demers-Dion, {2002} CAI 83 (Motion to 
authorize appeal granted (C.Q., 2002-10-01), deliberating since 2004-10-06) and La pratique de vérification de 
Videntité chez Valeurs Mobiliéres Desjardins, CAI # 02 03 76, 02 09 82, 02 09 83 and 02 13 83, March 25, 2003 (Inquiry 
Report). 

88 The Superior Court also ruled that the decisions and interpretations rendered under the ATI Act apply for the 
purpose of the interpretation of the Québec Private Sector Act [La Personnelle vie, Corporation d‘Assurance v. Cour 
du Québec, [1997] CAI 466 (S.C.)]. 
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necessary to an employer because of some specific matters relating to the employment. The 
criterion applied was that the personal information was “more than useful” in this specific context 
of employment.® In light of the evidence adduced in another case, social security numbers are not 
considered necessary since other information could be used for the identification purposes being 
expressed. 


Finally, in a recent decision rendered by the Court of Québec,” the court developed a method to 
determine and apply the “necessity” criterion. After a review of the relevant case law, the Court of 
Québec stated a seemingly new approach: 


“{33] The principle of interpretation, whereby necessity must be 
evaluated based on the purposes for which the information is 
required, is in keeping with the letter and the spirit of the Act. 
This is not a case of determining what “necessity” is, but rather, 
with a view to protecting personal information in all situations, to 
find what is necessary to the performance of each object the public 
agency claims such information is “necessary.” As regards the 
performance of this task, the Court notes the absence of any truly 
functional criterion of “necessity” in this case.” [Our translation] 


This decision was rendered in the context of the ATI Act. However, the Court of Québec 
considered the concept of “necessity” under the ATI Act and the Québec Private Sector Act to be 
the same. In its evaluation of the appropriate criteria, the court applies a test similar to the one 
developed in R. v. Oakes®. As privacy is a fundamental right protected by the Québec Charter 
and the C.C.Q., the court states that the information is deemed necessary when it is collected for 
a legitimate and important objective and the invasion of privacy is proportionately less important 
to those objectives. The court has therefore preferred a balanced approach in order to protect the 
fundamental rights of privacy, when required. 


(2.3) The“necessity” criterion as it relates to “consent” 


In Laval (Ville de) v. X.®, Justice Filion of the Court of Québec held that the “necessity” criterion 
cannot be “overridden” by the individual’s consent. Even if one consents to the collection of personal 
information, the criterion that this information be “necessary” to maintain ina specific file or record 
must still be demonstrated. In the absence of an express exception, both necessity and consent 
apply as cumulative conditions for the collection of personal information. Our understanding is 
that this same reasoning should apply to the use and disclosure of personal information as well, 
such that both the “consent” and “necessity” criteria must be met for an enterprise to be authorized 
to collect, use or disclose personal information. 


Previous to this, the CAI had also maintained that enterprises must establish the necessity for 


°° Bellerose v. Université de Montréal, [1988] CAI 377 (C.Q.). 
© Bayle v. Université Laval, [1992] CAI 240. 

*! Laval (Ville de) v. X, [2003] I1JCan 44085 (C.Q.). 

eT 1986)) eS: CROs: 

°° [(2003] IJCan 44085 (C.Q.). 
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2 THE COLLECTION OF PERSONAL INFORMATION (SECTIONS 4 TO 9) 


collecting personal information even when free and enlightened consent is obtained for the 
collection. One of the commissioners had dissented stating that, when consent is given, there is 
no requirement for the enterprise to demonstrate the necessity of the collection. Clearly, this 
commissioner's position has since been set aside by Justice Filion’s subsequent decision. 


(2.4) The requirement that personal information be collected directly from the person 
concerned, and related exceptions (section 6) 


Section 6 of the Québec Private Sector Act requires that personal information be collected from 
the person concerned, unless the latter consents to collection from third persons or an exception 
is applicable. 


There are cases where additional information could be sought from third parties. Except where 
exceptions apply, the person concerned must be informed and give his or her consent. 


The process of obtaining personal information about a person from a third party is a “two sided 
coin.’ Not only must the person seeking to obtain the information make sure that he or she is 
authorized to get the information from the third party, the third party must also make sure that 
he or she is authorized to communicate the information to the receiving party. Generally, before 
communicating such information, the third party must be authorized under sections 13, 14 and 15 
of the Québec Private Sector Act.” 


The exceptions that allow for the collection of personal information from third parties must 
be interpreted restrictively.” For example, when conducting an inquiry on an insurance claim, 
insurance companies may collect information from the third party in order to ensure the accuracy 
of the information.™ In credit references situations, a financial institution may also contact credit 
offices to check the accuracy of information when it is trying to retrace a client. 


(2.5) The prohibition on refusing to respond to a request for goods or services or to a 
request relating to employment by reason of the applicant's refusal to disclose 
personal information (section 9) 


Section 9 of the Québec Private Sector Act (somewhat similar to principle 4.3.3 in Schedule 1 
of PIPEDA) forbids any person from refusing to “respond” to a request for goods or services 
or to a request relating to employment by reason of the applicant's refusal to disclose personal 
information, except in limited situations expressly provided for, namely where: 


1) collection of that information is necessary for the conclusion or performance of a contract; 


+ Tremblay v. Caisse populaire Desjardins de St-Thomas, [2000], CAI 154 (Inquiry Report); See also Julien v. Domaine 
Laudance, [2003] CAI 77; A. v. C., [2003] CAI 534) and Agyemang v. Ipex Inc., [2001] CAI 201. 


6X. y. Agence de recouvrement Réjean Aubé inc., A.1.E. 96AC-75 (Inquiry Report). 


6 YX. y, Services aux marchands détaillants ltée, A.1.E. 96AC-101 (Inquiry Report) and X. v. Banque nationale du 
Canada, A.\.E. 96AC-103 (Inquiry Report). 


& X,and Banque Royale du Canada, A.1.E. 95AC-72 (Inquiry report). 
6 Duchesne v. Great-West (La), compagnie dassurance-vie, {1995} CAI 493. 


° Tremblay v. Caisse populaire Desjardins de St-Thomas, {2000} CAI 154. 
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2) collection of that information is authorized by law; or 
3) there are reasonable grounds to believe that the request is not lawful. 


However, the English version of section 9 of the Québec Private Sector Act does not appear to 
correspond with the intent of the Québec National Assembly. Although the English version uses 
the expression “no person may refuse to respond to a request... the French text reads “no person 
may refuse to acquiesce to a request ...” The French text appears to reflect the true intent of the 
legislature which was to provide not only that a person need respond to a request for goods or 
services (whether positively or negatively), but rather, that the person must respond positively 
(acquiesce) to that request (except when circumstances listed above are met). 


Section 9 of the Québec Private Sector Act provides consumers with added protection, ensuring 
that collection of their personal information is restricted and cannot be forced as a condition for 
providing goods or services, unless it is authorized by law, or is necessary for the conclusion / 
performance of the contract. In the latter case, the burden of proof lies on the enterprise to prove 
the necessity of collecting personal information as a condition for delivering goods or services. 


One example of application arose in the context of personal information being requested by a 
landlord as part of a rental application.” 


” A. v.C., [2003] CAI 534. 


3 USE AND DISCLOSURE OF PERSONAL INFORMATION (SECTION 13) 


3 


USE AND DISCLOSURE 
OF PERSONAL INFORMATION 
(SECTION 13) 


ne of the most fundamental principles embodied in the Québec Private Sector Act relates 

to the consent provision at section 13. An enterprise cannot use personal information 

about an individual for a purpose not relevant to the object of the file, or communicate (i.e. 
disclose) it to a third party, unless the enterprise obtains the individual's consent, or the enterprise 
is expressly authorized to do so under an exception in the Act. This provision is very clear and has 
been given a stricto sensu application. 


It is the enterprise’s responsibility to ensure that personal information about an individual contained 
in a file is only used in accordance with the object of the file (as identified and documented by 
the enterprise), or communicated to a third party with the informed consent of the individual or 
with the express authorization by the Act.’ Should an enterprise err and inappropriately use or 
communicate personal information, it may be held liable for damages.” 


Contrary to subsections 7 (1), (2) and (3) of PIPEDA, which refer to situations where personal 
information may be collected, used or disclosed without consent, respectively, section 18 of the 
Québec Private Sector Act refers only to situations where an enterprise may disclose personal 
information without consent. However, it is our view that section 18 should also apply to the use 
of personal information as an implied corollary of its disclosure. Consequently, section 18 should 
be interpreted as authorizing the third party who received the information under a disclosure 
exception, to also use it without consent accordingly to what is allowed by the exception (established 
by sections 18 to 26). 


The exceptions to the use of personal information without consent (section 13), are detailed in 
paragraph 4.2. 


71 X. y. Le Groupe Jean Coutu (P/J.C.) inc., [1995] CAI 128 and Laval (Ville) v. X., [2003] I1JCan 44085 (C.Q.). 


72 Roy v. Société sylvicole dArthabaska-Drummond, J.E. 2005-279 (C.Q.). See also chapter 7 — The liability of the 
enterprise and damages awarded. 
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4 


THE CONSENT PROVISION 
AN DaltiStENGEP MON 
(SECTIONS a1 4a O8z G) 


(4.1) Theconsent provision 
Section 14 of the Québec Private Sector Act reads as follows: 


14. Consent to the communication or use of personal information 
must be manifest, free, and enlightened, and must be given for 
specific purposes. Such consent is valid only for the length of time 
needed to achieve the purposes for which it was requested. 


Consent given otherwise than in accordance with the first 
paragraph is without effect. 


4.1.1 Validity of consent 


The requirements defining valid consent listed in section 14 of the Québec Private Sector Act 
emphasize the fact that, unlike PIPEDA, the Québec Private Sector Act does not allow implicit 
consent. Only explicit consents are valid. 


Consequently, under section 14 of the Québec Private Sector Act, it appears that any consent 
given must be explicit and cannot be implicitly inferred. This differs with the concept of consent 
under civil law, where it can be implicit (article 1386 C.C.Q.). 


However, even under the Québec Private Sector Act, the question remains whether consent can 
be considered inherent or intrinsic to a certain act or a specific situation at hand. For example, it 
has generally been held that a person suing for damages or requesting disability compensation 
from an insurance company consents to the disclosure of the relevant medical records.” It can be 
said that in such context the consent is intrinsic to the situation, being integral or inherent to the 
relationship and necessary interactions between the parties concerned. To be validly consented 
to, did the specific purpose need to be “expressly” listed, or is it sufficient that it be logically or 
naturally included in the initial purpose? 


7 Bédard v. Robert, J.E. 2003-589 (S.C.). 
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4 THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26) 


As will appear from the cases referred to below, establishing valid consent remains a task requiring 
just the right amount of fine-tuning to reflect the specific objects (“purposes”) to be covered and 
the necessity of the information to be collected, used or disclosed. The consent must not be too 
broad, otherwise it will be without effect. Nor must it be too narrow, or the enterprise could be 
prevented from collecting, using or disclosing personal information for an object which has not 
been specifically covered by the consent. 


4.1.2 Requirements for consent 


An insurer does not need to know the content of a medical record to pay for a semi-private 
room. The consent form must specifically indicate the purpose for which the information is to be 
obtained. Otherwise, the individual would not be able to make an enlightened decision regarding 
the reasons for which the information is being collected.”4 


In order for an individual to give an informed consent, the wording of the consent form for a 
credit evaluation, for example, must clearly indicate the names of the persons who are authorized 
to disclose information related to the person concerned and specify what information can be 
disclosed. The consent form must explicitly state that only necessary information will be collected. 
The enterprise that wishes to disclose personal information once the initial transaction is completed 
must give its client the opportunity to give consent. In such a case, the consent must be separate, 
optional and specific.” 


The consent of a union can be equivalent to the consent of the employees.” 


An employer’s company cannot view sensitive information intended for an insurance company, 
such as an employee's medical reports, without obtaining the prior consent of that employee. 
Moreover, medical reports are not deemed to be information that is necessary for the purposes of 
an “employee file” when they are given for insurance claim purposes only.” 


An enterprise cannot go through an intermediary to collect information concerning its client’s 
solvency without informing the latter of the intermediary's role (or engagement).”* 


The expression “financial relations” appearing in a consent form was deemed ambiguous and not 
explicit enough in one case to authorize a financial institution to disclose to the plaintiff's employer 
the cost of his rent and the amount of support paid.” 


In another case, it was ruled that a credit card company cannot conduct a semi-annual verification 
of its credit card holders’ records if no consent to such a credit inquiry was obtained during the 


credit card application process.*° 


74 Service daide au consommateur Vv. Reliable (La), compagnie dassurance-vie, [1996] CAI 406 (Inquiry Report). 
7 X. y, Services aux marchands détaillants ltée, [1996] CAI 408 (Inquiry Report). 


7° Association internationale des machinistes et des travailleuses et travailleurs de laérospatiale, section locale 2468 et 
Rolls-Royce Canada Itée, D.T.E. 2001T-153 (CA: 


7 Agyemang v. Ipex Inc., {2001} CAI 201. 

8X. v. Agence de recouvrement Réjean Aubé inc, [1996] CAI 401. 
7 X. v. Banque nationale du Canada, {1996} CAI 410. 

80 X. y. Sears Canada inc., [1996] CAI 390 (Inquiry Report). 
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If a psychiatrist is asked by the C.S.S.T. (“Workmen’s Compensation Board”) to evaluate a patient, 
a hospital is not entitled to disclose the patient’s medical record in its entirety without the latter’s 
prior consent.®! 


When a document containing personal information is given pursuant to a confidentiality 
undertaking, the document cannot be disclosed to a third party without the consent of the person 
concerned.” 


In the context of the application of the Québec Private Sector Act, the CAI once ruled that a 
consent provision can be limited in time when new circumstances arise which lead to believe 
that the consent is no longer applicable. For example, should a consent be given to an insurance 
company (with respect to a claim filed) and legal proceedings be instituted two years later with 
respect to this claim, the insurance company may be required to obtain a new consent in order 
to access certain documents concerning the claim. This is especially true when the consent is 
obtained in the context of an insurance claim where information is subsequently sought in judicial 
proceedings between an insured and his insurer.® 


In the context of a litigation over an insurance claim, the Supreme Court of Canada considered 
that, where an insurance company is given express and specific authorization by contract to access 
the medical file of an insured, the court has no discretion but to confirm the right to access the 
relevant portions of the file. In any event, the Supreme Court of Canada also ruled that a consent 
to the disclosure of the relevant medical information stemmed from the taking of the judicial 
proceedings. ** Of course, the courts will determine what are the relevant portions of a file. 


The situation before civil courts with respect to consent is different, because even if a judge is 
asked to consider privacy legislation, it will not restrict the judge from ordering the disclosure 
of some relevant information concerning the parties in a litigation process®. On the other hand, 
privacy legislation could serve as support for a party where the information sought about them is 
not clearly relevant or appears to be more of a “fishing expedition”®. 


(4.2) The exceptions to the consent provision 


Section 7 of PIPEDA provides exceptions to the consent requirements relating to the collection 
[7(1)], use [7(2)] and disclosure [7(3)] of information. Sections 13 and 18 to 26 of the Québec 
Private Sector Act create some exceptions to the consent provision as well. More specifically, they 
allow an enterprise, without the consent of the person concerned, to disclose personal information 


8! X. v. Hétel-Dieu de Québec, [1996] CAI 400 (Inquiry Report). 


® Pouliot v. Biochem Pharma Inc., [1996] R.J.Q. 1845 (S.C.) reversed by the Court of Appeal, [1997] R.J.Q. 1 (C.A.) on 
the grounds that the Québec Private Sector Act did not apply and on other factual grounds. 


Royal & SunAlliance du Canada v. Québec (Ministére de la Sécurité publique), A.1.E. 2004AC-71. 


Frenette v. Metropolitan Life Insurance Co., [1992] 1 S.C.R. 647. See also the recent decision by the Supreme Court of 
Canada in Glegg v. Smith & Nephew Inc., 2005 SCC 31 (May 20, 2005). 


Axa assurances inc. v. Gestion d’Artagnan inc., REJB 2001-25174 (C.S.); see also Société nationale de lamiante c. Lab 
Chrysotile inc., [1995] R.J.Q. 757 (C.A.) (Motion for autorisation to appeal before Supreme Court rejected (S.C.C., 
1995-09-07)) and 9083-2957 Québec inc. c. Caisse populaire de Riviére-des-Prairies, J.E. 2004-2000 (C.A.). 


Blaikie c. Commission des valeurs mobiliéres du Québec, ].E. 1990-595 (C.A.). 


86 
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4 THE CONSENT PROVISION AND ITS EXCEPTIONS (SECTIONS 14 TO 26) 


contained in a file on a person, and the receiving party to use that information for an object which 


the person concerned has already consented to, or for an object which is covered by the exceptions 
listed under sections 18 to 26. 


It is important to review some of the cases rendered under sections 18 to 26 of the Québec Private 
Sector Act, as they are somewhat different than those found in PIPEDA. 


4.2.1 Disclosure to authorized employees, mandataries or agents (section 20) 
Section 20 of the Québec Private Sector Act reads as follows: 


20. In the carrying on of an enterprise, authorized employees, 
mandataries or agents may have access to personal information 
without the consent of the person concerned only if the information 
is needed for the performance of their duties or the execution of their 
mandates. 


Under the Québec Private Sector Act, the disclosure of personal information within a given 
enterprise is restricted to: 


- persons (employees, mandataries or agents) who are authorized to obtain the 
information;*” and 


- when needed in the performance of their duties or the execution of their 
mandates. 


Summarily, the exception created by section 20 of the Québec Private Sector Act applies only to 
individuals who must necessarily access the personal information in order to fulfill their duties. 
These individuals hierarchical status (i.e., whether the person is the president or chairman) is not 
a determinative factor and the sensitivity of the information may not be taken into consideration 
in adapting the level of protection of the information. 


Consequently, an employer may not distribute a disciplinary notice to several foremen or permit 
further disclosure to an employee since only those who need the information for the performance 
of their duties may access the notice without the consent of the person concerned.™ 


Since paycheck slips contain some personal information that the immediate supervisor of the 
employees does not need to know, the information must be kept and handled in a confidential 


manner.*” 


A doctor may retain in his private clinic a copy of medical records compiled when patients visited 
a hospital emergency room, but only for diagnostic, follow-up and invoicing purposes. According 


*? Bill 86 suggests an amendment to specifically cover under section 20 the situation of any party to a contract for work 
or services, even when it does not qualify as a mandate or an agency. 


88 Xv. Komdresco Canada inc., A.1.E. 95AC-114 (Inquiry Report). 
8° Union des employées et employes de service, section locale 800 et For-Net inc., D.T.E. 97T-798 (A.T.). 
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to section 20 of the Québec Private Sector Act, the doctor’s employees may also access the file but 
only for invoicing purposes.” 


In one particular case, even if Equifax, acting as La Métropolitaine’s mandatary, was entitled to 
collect medical information on the plaintiff from her doctor, it was found that La Métropolitaine 
had the obligation to take all appropriate safety measures to ensure the confidentiality of the 
information. It should be noted that a verbal agreement between Equifax and La Métropolitaine 
was not sufficient.” 


Section 20 imposes on enterprises a duty to take the appropriate measures in order to limit access 
(and use) of personal information to only those authorized employees within the enterprise who 
need the information for the execution of their mandate or performance of their duties (the “need- 
to-know” principle). When third parties are involved, such as mandataries” or agents, the CAI 
imposes some very specific measures, which are added to the text of section 20 of the Québec 
Private Sector Act. When an enterprise transfers information to a third party (mandatary or agent), 
the CAI requires that it be accomplished through a written contract containing specific details. In 
Deschesnes v. Groupe Jean Coutu,” the CAI indicated that mandataries or agents may have access 
to the personal information of the enterprise without the consent of the person concerned in 
accordance with the conditions of section 20, but only once the following additional requirements 
are fulfilled: 


a) the contract between the enterprise and the mandatary is in writing; 
b) the contract must specify: 
(i) the scope of the mandate; 
(ii) the purposes for which the mandatary (agent) wants to use the 


information (re: the object of the file); 


(iii) the category of individuals who would have access to the 
information; and 


(iv) the obligation to keep the information confidential. 


According to the CAI, this written contract requirement is necessary in order to accomplish its 
role of supervising the implementation of the Québec Private Sector Act. The absence of a written 
agreement could result in situations where personal information could circulate without any real 
control being exercised by the enterprise that has the responsibility to protect the information. 


* Yv. Centre hospitalier Hétel-Dieu dAmos, A.1.E. 97AC-93 (Inquiry Report). 
*) X. v. Métropolitaine (La), [1995] A.1.E. 95AC-46 (Inquiry Report). 


*” A mandatary is a person empowered to represent another party, the mandator, in the performance of a juridical act 


(article 2130 C.C.Q.) 
°3 [2000] CAI 216. 
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4.2.2 Disclosure in a context of investigation [section 18 (3) and in fine] 


“18. A person carrying on an enterprise may, without the consent 
of the person concerned, communicate persenal information 
contained in a file he holds on that person... 


(3): to a person responsible, by law, for the prevention, detection 
or repression of crime or statutory offences who requires it in the 
performance of his duties, if the information is needed for the 
prosecution of an offence under an Act applicable in Québec; ... 


A detective or security agency holding a permit issued under the Act 
respecting detective or security agencies (chapter A-8), or a body 
having as its object the prevention, detection or repression of crime 
or statutory offences and a person carrying on an enterprise may, 
without the consent of the person concerned, communicate among 
themselves the information needed for conducting an inquiry for the 
purpose of preventing, detecting or repressing a crime or a statutory 
offence. The same applies in respect of information communicated 
among persons carrying on an enterprise, if the person who 
communicates or collects such information has reasonable grounds 
to believe that the person concerned has committed, or is about to 
commit, a crime or statutory offence against one or other of the 
persons carrying on an enterprise.” 


The Superior Court ruled that an investigator employed by the “Insurance Crime Protection Bureau’ 
(hereinafter the “ICPB”), is authorized, in accordance with subsection 18 (3), to communicate to the 
“Social Security Authority” personal information without the consent of the person concerned. Both the 
investigator and the ICPB had a permit issued under the Act respecting detective or security agencies.” 


4.2.3 Disclosure when required or authorized by law or by collective agreement [section 
18(4) and (6)/ 


Subsection 18 (4) of the Québec Private Sector Act reads as follows: 


“18. A person carrying on an enterprise may, without the consent 
of the person concerned, communicate personal information 
contained in a file he holds on that person ... 


(4): ... to. a person to whom it is necessary to communicate the 
information under the law or a collective agreement, who requires 
it in the performance of his duties; ... 


(6): ... to a person or body having the power to compel 


communication of the information if he or it requires it in the 
exercise of his or its duties or functions; ....” 


°% Charest v. Tribunal administratif du Québec, J.E. 2002-628 (S.C.). 
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Where a collective agreement permits an employer to deposit expenses owing to employees directly 
in their account, the employer could use the account numbers it already uses for paychecks to 
deposit those amounts. The consent of a union is equivalent to the consent of the employees.” 


Under the Québec Private Sector Act, an employee may likewise obtain from his employer the 
communication of documents needed in the dispute of a grievance involving the application of a 
collective agreement.” 


On apreliminary objection, the T.A.Q. held that, under subsections 18 (4 to 6) and related provisions, 
medical reports possessed by an insurer may be communicated to the Régie des rentes du Québec, 
even without the consent of the applicant, in order to determine if an individual is eligible to receive 
a disability pension, because the law grants the power of investigation and access.” 


On the other hand, lawyers do not have the power to compel witnesses to provide them directly 
with information as they only have the power to sign writs of subpoena duces tecum. The goal of 
the issuance of the writ is to force a witness to present himself in front of a judge who is legally 
entitled to compel the production of any document, in accordance with subsection 18 (6) of the 
Québec Private Sector Act. Permitting lawyers to directly obtain documents from a third party 
and to access information that otherwise could not be disclosed without the consent of the person 
concerned would short circuit the judicial process.”* The information remains confidential and can 
only be communicated on the direction of the court.” 


Generally speaking, the Québec Private Sector Act does not constitute, in and of itself, a valid 
reason to refuse the disclosure of a document in legal proceedings.'” 


4.2.4 The exception of research purposes and information on professionals (sections 21 
and 21.1) 


Section 21 gives the CAI discretion to grant a person authorization to access personal information 
for study, research or statistical purposes without the consent of the person concerned, subject to 
several criteria and modalities, such as the intended use is not frivolous and the ends contemplated 
cannot be achieved otherwise, and the information will be used in a manner that will ensure its 
confidentiality. Since 1994, the Commission has granted a number of authorizations according to 
this section (such authorizations are not systematically made public per se). 


In 2001, section 21.1 was added to the Act giving the CAI further discretion to grant access to 
personal information on professionals about their professional activities. This exception is subject 
to the following criteria: 


a) previous consultation with the professional Order concerned; 


Association internationale des machinistes et des travailleuses et travailleurs de laérospatiale, section locale 2468 et 
Rolls-Royce Canada Itée., D.T.E. 2001T-153 (T.A.). 


°° Syndicat des travailleuses et travailleurs de Spectube inc. (ES.S.A.) and Spectube inc., D.T.E. 2003T-1049 (A.T.). 
” Affaires sociales — 387, [2000] T.A.Q. 21 (T.A.Q.). 

°° X.and Banque Royale du Canada, A.1.E. 95AC-72 (Inquiry report). 

” McCue v. Younes, 2002 IJCan 30581] (S.C.). 

' 9083-2957 Québec inc. v. Caisse populaire de Riviére-des-Prairies, }.E. 2004-2000 (C.A.) 
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b) respect for professional secrecy; 

c) the professional will be notified periodically of the intended uses and ends 
contemplated; 

d) the professional will have an opportunity to opt-out; 

e) security measures are in place to ensure confidentiality of information. 


The authorizations must be revised annually and the list of authorized persons is published. 


The case law relating to sections 21 and 21.1 had to do with the Commission decision to amend an 
authorization granted under section 21 back in 1994 to read more restrictively in 2001. 


The enterprise involved, I.M.S. du Canada Ltée, (“I.M.S.”) collects prescription information 
from pharmacists in order to compile and analyze prescription practices of physicians, which is 
subsequently sold to pharmaceutical companies for marketing purposes. In August 2001, the CAI 
decided that I.M.S. was collecting personal information about physicians and limited the previous 
authorization that had been granted in 1994 such that I.M.S. could no longer collect information 
related to specific physicians. Seeking judicial revision of this decision, I.M.S. asked the Superior 
Court for a stay of execution on the grounds that the Commission's decision jeopardized its 
activities. The stay was granted by the Superior Court'”. In the meantime, section 21.1 that had 
been adopted by the legislator, was now sufficiently broad to authorize I.M.S. to continue its 
activities as before. I.M.S. eventually discontinued its proceedings on August 6", 2002. 


It is interesting to note that Privacy Commissioner of Canada rendered a report of finding 
concluding that the information collected by 1.M.S. does not constitute personal information’. 
In March 2005, in a decision rendered in file no. 04 17 07, the CAI granted to an enterprise, under 
section 21.1 of the Quebec Private Sector Act, the authorization to receive communication from 
pharmacists of some personal information on prescription drugs. The CAI specifically underlined 
that information on the Pharmacy (Identification) Number, its Postal Code, the dates of the 
transactions, the costs of the drug and the mode of payment are personal information on the 
activities of the pharmacy owners.’ 


4.2.5 The exception of nominative lists (sections 22 to 26) 
A nominative list is a list of the names, addresses or telephone numbers of natural persons. 


This exception allows the use of nominative lists for the purpose of commercial or philanthropic 
prospection without the consent of the persons concerned. In spite of the apparent requirement 
under section 14 for express consent, the Québec Private Sector Act exceptionally allows an 
enterprise to use the “opt-out” consent. The person who is to be added to the list must be given 
a valid opportunity to refuse that his/her personal information be used or to be deleted from 
the list. In fact, every person who, on the basis of a nominative list, engages in commercial or 


101 M.S. du Canada Itée c. Commission dacces a l'information, }.E. 2002-511 (S.C.). 
102 PIPEDA Case Summary #15, http://www.privcom.gc.ca/media/an/wn_011002_e.asp. 


103 Décision en regard du rapport pour le traitement d'une demande faite par Apaxys Solutions inc. et visée par larticle 
21.1 de la Loi sur la protection des renseignements personnels dans le Secteur privé/, available online on the CAI 
website (http://www.cai-gouv.qc.ca). 
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philanthropic prospection through postal or telecommunications channels, must identify himself 
and inform the person to whom he is addressing himself of the latter’s right to have the personal 
information concerning him deleted from the list that he holds (section 24). 


The Québec Private Sector Act even allows an enterprise, without the consent of the persons 
concerned, to disclose a nominative list or any information used to establish such a list to a third 
person. Section 22 of the Québec Private Sector Act sets out the following requirements: 


22. A person carrying on an enterprise may, without the consent of the 
persons concerned, communicate a nominative list or any information used 
to establish such a list to a third person, if 


1) the communication is made pursuant to a contract that includes a 
stipulation prohibiting the third person from using or communicating the 
list or the information for purposes other than commercial or philanthropic 
prospection; 


2) prior to the communication, in cases where the list is a nominative list of 
the person’s clients, members or employees, the persons concerned are 
given a valid opportunity to refuse that the information be used by a third 
person for purposes of commercial or philanthropic prospection; and 


3) the communication does not infringe upon the privacy of the persons 
concerned. 


A nominative list is a list of the names, addresses or telephone numbers of 
natural persons. 


A person requesting information on classes offered by a school does not become a “client” under 
subsection 22 (2) of the Québec Private Sector Act, and therefore, his name cannot be put on a 
nominative list accessible to third parties.!™ 


A hospital must obtain the consent of its patients prior to communicating their information to its 
foundation for solicitation purposes if that foundation is to meet the requirements of section 24 
of the Québec Private Sector Act. The foundation being a “private enterprise,’ it must comply with 
the requirement of section 24 and give the person an opportunity to have their name removed 
from the list.'° 


Personal information on clients extracted froma pharmacist’s files, other than names and addresses, 
does not fall within the scope of the exception concerning the use or disclosure of a nominative list. 
Accordingly, the addition of targeted information (such as the salary or the sectors of activity) to 
the names and addresses or telephone numbers would change the nature of the list to something 
more than merely nominative and therefore, could no longer qualify as an exception to the consent 
requirement under section 22.1% 


104 X. v. Institut de Carriére Universel, A.1.E. 96AC-106. 
105 _X, v. Hotel-Dieu de St-Jéréme, A.1.E. 97AC-45. 
106 Deschesnes v. Groupe Jean Coutu, [2000] CAI 216. 
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ACCESS AND RECTIFICATION PROVISIONS 
(SECTIONS 27 TO 41) 


(5.1) The individual's rights of access and rectification 


Through the C.C.Q., the Québec Private Sector Act grants the individual concerned the right to 
access his or her file held by an “enterprise” and to ask for its rectification when the information 
contained is inaccurate, incomplete or equivocal.'” When a rectification is requested, the burden 
lies on the “enterprise” to prove that the information is accurate, complete and unequivocal, 
unless the information was communicated directly by the person concerned or with that person's 
consent.!"* 


It is important to note that, for access and rectification purposes, a “file” (or “record”) encompasses 
more than what is physically contained in a folder bearing the name of the person concerned. All 
administrative notes containing personal information on the person concerned are deemed to be 
part of the “file” and therefore accessible. !” 


The right of access only applies to personal information on the individual concerned; if the 
information does not concern him, there is no right of access under the Québec Private Sector 
Act.''® This general rule is excepted from only when provided for by the Act, such as, when access 
is requested by the spouse and direct ascendants or descendants of a deceased person (section 
31). 


Under section 36 of the Québec Private Sector Act, the person holding information that is the 
subject of a request for access or rectification must, if he does not grant the request, retain the 
information for such time as is necessary to allow the person concerned to exhaust the recourses 
provided by law. Except where section 36 of the Québec Private Sector Act applies, enterprises 
may destroy personal information without permission or further formality.” 


07 Articles 38 and 40 C.C.Q. and sections 27 to 28 of the Québec Private Sector Act. 


168 Section 53 of the Québec Private Sector Act. 


109 X vy, S.E.M.O. Drummond inc., [1998] CAI 364. See also Assurance-vie Desjardins Laurentienne inc. v. Stébenne, }.E. 
97-1951 (C.Q.), confirmed by Superior Court: Assurance-vie Desjardins-Laurentienne inc. v. Boissonnaullt, J.E. 1998- 
995 (S.C.) (Appeal rejected, C.A. 2001-11-08). 


110 _X, vy, Compagnie Wal-Mart du Canada, A.1.E. 2004AC-85. 


1 Congrégation des Témoins de Jéhovah D'Issoudun-Sud v. Mailly, }.E. 2000-1776 (C.Q.). And for a disclosure on 
“retention periods’, see chapter 6 below. 
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Although information contained in someone's credit report may cause him harm, this is not a 
ground for rectification, when information is accurate.'” In credits files, an accurate inscription 
may be removed only where authorization is given from the creditors who have asked that the 
inscription be put in the credit file.' 


However, when the information is inaccurate or collected illegally, rectification requests will be 
granted under section 28 of the Québec Private Sector Act combined with article 40 C.C.Q.'* One 
may note that the rights granted by section 28 of the Act are in addition to the rights provided by 
article 40 C.C.Q. Moreover, article 40 C.C.Q. also allows, in certain circumstances, a person to 
deposit his written comments in the file. 


(5.2) Exceptions to the principle of access and rectification (sections 37 to 41) 


Sections 37 to 41 of the Québec Private Sector Act set forth exceptions that can be raised by 
an enterprise against an individual's application for access or rectification. As exceptions to the 
principle of access and rectification, these exemptions should be interpreted restrictively.'® 


Dina’! Serious harm to a person's health (sections 37-38) 


A first exception relates to access to medical files. Although most of the case law has been developed 
under the ATI Act or under sectoral statutes relating to the health sector (see chapter 7), some 
cases were rendered by the CAI under the Québec Private Sector Act. 


The purpose of this exemption is to protect the individual concerned from the effects that the 
disclosure of their medical record could have on them. This exception is “temporary” in nature. 
The disclosure of the file can be refused if its consultation would result in serious harm to the 
person’s health. Once the situation has changed, access should be granted (although it should be 
done through a physician). 


We note that a person of less than 14 years of age desiring to access his/her medical record must 
act through his attorney in a context of judicial proceedings or through the holder of parental 
authority (section 38). 


When a refusal is based on this exception, it is appropriate for the enterprise to wait for the 
individual concerned to designate a physician to receive the medical record. Also, the medical 
situation of the person concerned must be assessed at the time the application access is filed, not 
at the time of the hearing before the CAI’"® 


2X. y, Equifax Canada inc., [1995] CAI 286; Hallis v. Equifax Canada inc., [1996] CAI 107 and Ravinsky v. Equifax 
Canada inc., [2003] CAI 46. 


43 Ohayon v. Trans Union du Canada inc., CAI 01 11 33, June 18", 2002, c. C. Constant. 


"4 Boisvert Bélisle v. Pharmacie Jean Coutu, CAI 94 16 07, December 7", 1995, c. M. Laporte; X. v. Vision Trust Royal, 
[1994] CAI 290 and Woél v. Nissan Canada Finances inc., [1999] CAI 403. 


"SX. v. Zurich du Canada, compagnie dassurance-vie, [1995] CAI 119 (Discontinuance of the appeal (C.Q., 1997-03- 
20)). 


Ne Sicard v. Subak, }.E. 2000-1229 (C.Q.). 
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An employer has no right to ask employees why they want to access (or receive a copy of) their 
medical record.” 


Earlier cases raised the issue of whether or not other exemptions provided for in the Québec 
Private Sector Act could be raised by enterprises (which also invoked sections 37-38 of the Québec 
Private Sector Act), as the basis for their refusal to grant access to a medical record. It appears now 
that it can be invoked alongside with other exceptions to disclosure, such as the one relating to the 
likelihood that the information will affect judicial proceedings [see paragraph 5.2.2].!'8 


Se & Likelihood of affecting judicial proceedings [subsection 39 (2)] 


This is probably the exception that has been most often examined in decisions rendered under the 
Québec Private Sector Act. Many of these cases involve insurance companies that refused to give 
individuals access to their file following the insurance company’s refusal to cover a claim. There are 
many cases also related to access to medical expertise in the context of labour relations. 


Unlike subsection 9(3)(d) of PIPEDA, subsection 39 (2) of the Québec Private Sector Act does not 
require that information that an enterprise wishes to protect be generated in the course of a formal 
dispute resolution process.'!? Subsection 39 (2) focuses rather on the likelihood that disclosure of 
the information will affect judicial proceedings. To be applicable, this exception generally requires 
that: 


- The file contains personal information concerning the person making the request; 


- The refusal is related to judicial proceedings, although the proceedings need not be filed. 
However, there must be serious indication that proceedings will eventually be filed (for 
example, a formal letter of demand, or an admission made by the person concerned); 


- The personal information to be disclosed be likely to have an impact (not necessarily 
decisive) on existing or potential judicial proceedings; and 


- These conditions must have existed at the time the enterprise indicated its refusal to 
120 


grant access. 
The burden of proof to demonstrate the likelihood that the disclosure may affect judicial 
proceedings lies with the enterprise.'” 


7 Olymel, société en commandite (établissement St-Simon) and Syndicat des travailleurs d'Olympia (C.S.N.), D.T.E. 
99T-497 (A.T.). : 


8 J.q Personnelle Vie, Corporation d’Assurance v. Cour du Québec, [1997] CAI 466 (S.C.). 


19 Général Accident Compagnie dAssurance du Canada v. Ferland, {1997} CAI 446 (C.Q.); note that when professional 
secrecy is pleaded, the issue regarding whether or not information must be generated in the course of a formal 
dispute resolution process remains, to date, unsettled: Paul Revere, Compagnie dassurance-vie v. Chainé, }.E. 2000- 
1180 (C.Q.) and Sécurité (La), assurances générales v. Gravel, J.E. 2000-1129 (C.Q.). 


120 Pichette v. SSQ-Vie, [1995] CAI 4 (Motion to appeal dismissed); Personnelle vie, corp. dassurance v. Cour du Québec, 
[1997] CAI 466 (S.C.). 


11 Bolduc v. Cété, [1994] CAI 219; Turgeon v. Company dassurance Bélair, [1995] CAI 11. 
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Determining the likelihood that the disclosure may affect judicial proceedings is generally a 
question of fact. Sometimes, the testimony of the person concerned will be considered sufficient to 
determine his or her intention to institute legal proceedings.’” At other times, even if the person 
concerned testifies that he or she has no intention to sue, the sending of a formal letter of demand 


may indicate an intention to the contrary.” 


We must also note that this exception can apply even when the potential litigation does not occur 
between the parties disputing the right to access an individual’s record. Moreover, the enterprise 
is under no obligation to prove that the impact, if any, will be decisive. Its burden is to show that 
there is a reasonable relation between the disclosure and the likelihood of an impact on judicial 
proceedings.’ 

Generally, it has been recognized that this exception also applies to quasi-judicial proceedings 
(such as grievance arbitrations).’” 


5.2.3 Personal information of third parties (section 40) 


According to subsection 9(1) of PIPEDA, an organization shall not give an individual access to 
personal information if doing so would likely reveal personal information abouta third party (except 
if the third party consents or the individual needs the information because someone’s life, health 
or security is threatened). Under section 40 of the Québec Private Sector Act, an enterprise also 
has the duty to refuse access to an individual’s personal information if, by doing so, the disclosure 
would likely reveal personal information about a third person or the existence of such information 
and the disclosure may seriously harm that third person. 


The third party protected contemplated in this exception is an individual in his or her personal 
capacity.’° 


This exception generally takes “precedence” over an access request, since third parties are often not 
parties to the access and rectification dispute. The tribunal takes it upon itself to protect the third 
parties in order to avoid that prejudicial personal information be disclosed, even if the Québec 
Private Sector Act does not explicitly impose that duty on the tribunal.!”” 


This exception was examined more frequently from the perspective of a person’s right to obtain 
access to his or her file, including the name of the persons who filed a complaint against him or her. 
Comparing section 40 of the Québec Private Sector Act with section 88 of the ATI Act, the CAI 


12 Turgeon v. Companie dassurance Bélair, [1995] CAI 11. 


23 Assurance-vie Desjardins Laurentienne inc. v. Morin-Gauthier, J.E. 1997-1950 (C.Q.). See also Général Accident 
Compagnie dAssurance du Canada v. Ferland, [1997] CAI 446 (C.Q.), where the CAI could not be satisfied by the 
testimony of the person concerned when it was unclear whether the person did not intend to sue, especially when 
that person refused to sign a release document. 


24 Hermann-Busson v. Service anti-crime des assureurs, [1999] CAI 287. 


% Bolduc v. Coté, [1994] CAI 219; Rioux v. Recyclage Kebec inc., [2000] CAI 117; Papaeconomou v. Pratt & Whitney 
Canada, [2000] CAI 41. 


% Lavoie v. Pinkerton du Québec Itée, [1996] CAI 67 and Poulin v. Caisse Populaire de Ste-Marguerite-de-Lingwick, 
[2002] CAI 316. 


7 Turgeon v. Compagnie dassurances Bélair, [1995] CAI 11; Gravel v. Sécurité (La), assurances générales, [1999] CAI 83 
(Appeal granted on the question of professional secrecy, (C.Q., 2000-04-12)). 
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refused to grant access to an individual's file where he could find the name of a person who filed a 
complaint against him, because of the likelihood that the individual might take action against the 
complainant on the basis of the information obtained.!” 


The CAI has generally recognized that, under the ATI Act, the name of a complainant is considered 
personal information about a third person where the disclosure may seriously harm this third 
person.’”. The “serious harm” test was met in a case where the person concerned was seeking the 
name of a third party in order to initiate legal proceedings against them.’ In a converse example, 
where there was insufficient evidence of actual harm resulting to a third party, the third-party 
exception was set aside and access was granted.'*! It has also been held that the disclosure of 
personal information about the third party already known to the person seeking disclosure cannot 
constitute serious harm within the meaning of section 40 of the Québec Private Sector Act.'” 


It is very interesting to note that under federal Acts'*’, the Federal Court of Appeal recently held 
that the judge must balance the private and public interests at stake when considering a request for 
access to personal information. In this case, the plaintiff was denied access to interview notes that 
were taken during the course of an investigation into allegations of discrimination and harassment 
that were made against him and resulted in the relief of his duties. In reviewing this ruling, and 
in balancing the private and public interests, Mr. Justice Décarie held that the private interest in 
protecting the interviewees’ working and personal relationship with the plaintiff (including the 
possibility of being sued) was minimal compared to the private interest of the plaintiff to know 
what was said about him, and the broader public interest of ensuring fairness in the conduct of 
administrative inquiries. 

In contrast, however, the CAI has refused to consider personal opinions expressed by a third 
party with respect to the person concerned as personal information about those third parties, 
within the meaning of section 88 of the ATI Act, when these opinions, or action taken, occurred 
in the execution of the employment of the third party.'® This appears consistent with the decision 
rendered by the CAI in Leblond v. Assurances générales des Caisses Desjardins’* on the definition 
of personal information [see paragraph (1.4)]. 


128 Harris v. Aéroports de Montréal, [1994] CAI 259. 


2° Larocque v. Repentigny, A.1.E. 2004AC-98; Hébert c. Régie de lassurance maladie du Québec, {1994} CAI 136 and 
Corp. d’habitations Jeanne-Mance c. Laroche, }.E. 97-1738 (C.Q.). 


130 XY y. La Capitale assurances générales inc., CAI # 03 04 91, November 13, 2003, c. H. Grenier. 
131, Nadeau c. Contrevent (Le), [1996] CAI 171. 


132 Villeneuve v. Laliberté & Associés inc., [2003] CAI 207; Gauthier v. Syndicat des employées et employés de la 
Bibliotheque de Québec, [1997] CAI 1. ‘ 


133, Access to Information Act, R.S.C. 1985, c. A-1 and Privacy Act, R.S.C. 1985, c. P-21. 


'3 Canada (Information Commissioner) v. Canada (Minister of Citizenship and Immigration), 2002 FCA 270; See 
also ERECHETTE, Gaston, Evolution de la jurisprudence en matiére de renseignements nominatifs, droit dacceés et 
protection, in Développements récents en droit de l'accés a l'information, vol 212, p. 151. 


5 Giroux v. Centre daccueil La Cité des Prairies inc., [1993] CAI 53 (CAI); Leroux v. Québec (Ministére de la sécurité 
publique), [1993] CAI 299 (CAI). 


136 [2003] CAI 391 (Appeal granted on questions of professional secrecy, J.E. 2004-2148 (C.Q.)). See also paragraph 
(isl) 
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5.2.4 Other exceptions to the applications for access and rectification 


Although it is generally recognized that the only applicable exceptions to the right of access and 
rectification are those specifically listed in the Québec Private Sector Act,'*”’ in some cases, “public 
interest” may allow an enterprise to justify a refusal to grant access to an individual’s file. For 


example, an individual cannot access documents that are protected by professional secrecy (such 


as solicitor-client privilege), even if the information is kept in the individual’s file.'°* 


‘8? Morin- Gauthier v. Assurance-vie Desjardins, [1994] CAI 226 (Appeal granted on the application of s. 39(2) J.E. 1997- 
1950 (C.Q.)); X. v. Les Services de Santé du Québec, [1994] CAI 263; Duchesne v. Minerais Lac Ltée — La Mine Doyon, 
[1997] CAI 214 (Motion to appeal granted (C.Q., 1997-10-15), Discontinuance of the appeal (C.Q., 1998-04-14)); 
Assurance-vie Desjardins-Laurentienne inc. v. Boissonnault, J.E. 1998-995 (S.C.) (Appeal rejected, C.A. 2001-11-08) 
and Chainé v. Gauthier, [1998] CAI 153 (Appeal rejected (C.Q., 2000-04-27)); Chainé v. Paul Revere, Compagnie 
dassurance-vie, [1998] CAI 139 (Appeal rejected (C.Q., 2000-04-27)). 


88 Jou v. Allstate du Canada, compagnie dassurances, [2003] CAI 640; Handfield v. Compagnie dassurance-vie 
Transamerica du Canada, [1999] CAI 4 (Appeal dismissed (C.Q., 2000-02-14), Motion for evocation dismissed (S.C., 
2000-05-26)). See also paragraph (1.1) on solicitor-client privilege. 


oe 


6 RESPONSIBILITY TO SAFEGUARD PERSONAL INFORMATION 


6 


RESPONSIBILITY TO 
SAFEGUARD PERSONAL INFORMATION 


ections 10, 11 and 12 of the Québec Private Sector Act impose various obligations on 

enterprises, including the obligation to implement safety measures to ensure the confidentiality 

of the information held (section 10), ensure that it is up to date and accurate (section 11) and 
prevent further use of that information once the object of a file has been achieved (section 12). 


One example of the application of section 10 involves a case where a trustee in bankruptcy took 
over the administration of the activities of an enterprise in the context of a bankruptcy. It produced 
a list containing the names, social insurance numbers and amounts paid to every employee to the 
federal authorities, then disclosed the list to every employee. This was found to be contrary to the 
obligation under section 10 to ensure the confidentiality of personal information.'*” 


It is interesting to note that currently, the Québec Private Sector Act does not, per se, allow an 
enterprise to adapt its safeguard measures based on the sensitivity of the information.'” This is to 
be contrasted with principle 4.7.2 of PIPEDA that does allow for the nature of the safeguards to vary 
depending on the sensitivity of the information that has been collected, the amount, distribution, 
and format of the information, and the method of storage. However, should it come to pass, Bill 
86 seeks to incorporate a criterion of reasonableness as part of the obligation to adopt safeguards, 
which in turn will depend on the sensitivity of the information, the purposes for which it is to be 
used, the quantity and distribution of the information and the medium on which it is stored. 


Section 11 deals more specifically with the duty of enterprises to use accurate and updated personal 
information. One should note that this duty does not exempt enterprises from collecting consent 


to update personal information™’. 


139 ¥. and Poulin de Courval Cie, A.I.E. 97AC-49 (Inquiry report). 


14 Notwithstanding the above, the Commission daccés 4 l'information was mindful of the sensitivity of information in 
some decisions rendered under the ATI Act, see X. and Y. v. Hépital du Sacré-coeur de Montréal, CAI 98 13 00, July, 
16, 2002, c. C. Constant, J. Stoddart and M. Laporte; X. v. Ville de Saint-Laurent, CAI 97 04 78, June 14", 2000, 
c. P-A. Comeau; X. v. Centre de protection et de réadaptation de la Céte-Nord, CAI 02 06 08, July, 24", 2003, c. D. 
Boissinot and X. v. Ministére de la Sécurité Publique, CAI 02 06 20, August 4", 2003, c. D. Boissinot. 


141 X. y, Sears Canada inc., A.1.E. 96AC-34 (Inquiry Report). 
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Unlike principle 4.5.3 of Schedule 1 to PIPEDA, section 12 does not require enterprises to destroy 
personal information once the object of the file has been achieved. Rather, section 12 of the Québec 
Private Sector Act prohibits the further use of such personal information once the object of the 
file has been achieved. The case law clearly holds that the information need not be destroyed by 
enterprises. However, enterprises cannot use it any longer, unless the person concerned consents 
to the new usage, subject to the time limit prescribed by law or by a retention schedule established 
by government regulation. '” It is to be noted that the Québec government has still not adopted a 
retention schedule to date.’ 


2 Equifax Canada inc. v. Fugére, [1998] J.E. 1999-2363 (C.Q.); Julien v. Domaine Laudance, [2003] CAI 77; Thibault v. 
Capitale (La), compagnie dassurances générales, [2001] CAI 78. 


‘8 Bill 86 proposes to repeal the specific power granted to the government to establish retention periods (section 102). 
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THE. CIABICED WZ Obs Be 
ENTERPRISE AND DAMAGES AWARDED 


nder the Québec Private Sector Act, the CAI is granted the power to examine and decide 

a dispute relating to a legislative provision concerning access or rectification of personal 

information (section 42). The CAI is also vested with the powers to issue recommendations 
(following an inquiry) of such remedial measures as are appropriate to ensure the protection of the 
personal information. Unlike section 167 of the ATI Act, the Québec Private Sector Act does not 
grant the CAI specific power to award damages for a violation of a duty imposed on an enterprise 
with respect to the protection of the personal information. 


Under the civil law regime, however, an enterprise may become liable in damages should it collect, 
retain, use or disclose personal information in violation of the Québec Private Sector Act. Such 
remedy should be sought before the appropriate court of justice. 


Under the civil law principles, an enterprise will be liable for damages if a plaintiff demonstrates 
that the enterprise acted wrongfully, that the action resulted in damages to the plaintiff, and that 
there is a causal relationship between the damages suffered and the wrongful action. 


For instance, during divorce proceedings, a plaintiff asked a bank to cease giving information about 
her account to her soon-to-be-ex-husband. The bank failed to do so. The Commission ruled in a 
first judgment that the bank failed to comply with section 13 of the Québec Private Sector Act. The 
plaintiff then sued the bank for damages related to the disclosure, because her “husband” ceased 
to pay her pension and she had to negotiate with a new bank to switch her accounts. The Court 
awarded $1,000 in damages.'™ 


Another plaintiff was excluded from a social club for elderly people. A notice was posted in 
the basement of the church to this effect, also specifying the reason why he was excluded. In a 
previous judgment, the Commission ruled that the notice of exclusion posted contained personal 
information and demanded that the notice be removed to comply with section 10 of the Québec 
Private Sector Act. The plaintiff then sued for moral damages for the humiliation suffered. The 
court awarded $500.'* 


4 Demers v. Banque Nationale du Canada, B.E. 97BE-330 (C.Q.). 
148 Chartrand v. Corp. du Club de lamitié de Plaisance, B.E. 97BE-878 (C.Q.). 
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A credit bureau had left a mistaken mention of “bankruptcy” in the file of a plaintiff. The 
information was not up to date and accurate when used, contrary to section 11 of the Québec 
Private Sector Act. Although the plaintiff made numerous demands, the file was not rectified. The 
plaintiff suffered humiliation and incurred a lot of costs and spent much time on this matter. The 
court awarded $800 in general damages and $1,500 in punitive damages. One of the important 
considerations for awarding damages in this case was the fact that the enterprise did not give him 


access to his personal information.’ 


One plaintiff sued an enterprise for damages following illegal disclosure of personal information. 
Asa native, he was exempted from tax on car rentals. One employee of the enterprise, a car dealer, 
used the plaintiff’s personal information, despite his refusal, to save taxes for another person. This 
other person was a bad debt risk, and inscriptions were made in the plaintiff’s credit report. There 
was no liability against the enterprise as an employer or as a participant of the fraud. Its liability 
was based on section 10 of the Québec Private Sector Act, because the employee did not take 
sufficient measures to protect the plaintiff’s personal information. The damages awarded were in 
the order of $2,000 in lawyer’s fees in order to rectify the credit file, $5,000 in moral damages and 
$5,000 in punitive damages to be paid personally by the delinquent employee.’”’ 

In Basque v. GMAC Location Limitée, the plaintiff sued the enterprise for damages because GMAC 
communicated personal information to credit companies (Equifax and Trans-Union) that resulted 
in credit card companies refusing the plaintiff’s applications for the issuance of a credit card. The 
court ruled that GMAC transferred the information to Equifax and Trans-Union without a valid 
consent. The court did not even consider the veracity of the information communicated and 
awarded $500 in damages.’*8 


Another enterprise disclosed confidential personal information not permitted under any express 
provision of the Québec Private Sector Act. Violation of section 13 was held to constitute a fault 
under civil law and to engage liability. Therefore, the court awarded $2,500 in moral damages, 


$2,000 in punitive damages and $1,000 for trouble and inconveniences.” 


46 Boulerice v. Acrofax inc., [2001] R.L. 621 (C.Q.). 
47 Stacey v. Sauvé Plymouth Chrysler (1991) inc., J.E. 2002-1147 (C.Q.). 
“8 Basque v. GMAC Location Limitée, 2002 IlJCan 36125 (C.Q.). 


® Roy v. Société sylvicole dArthabaska-Drummond, J.E. 2005-279 (C.Q.). 
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SPECIAL QUEBEC LEGISLATIVE RULES 
GOVERNING THE COLLECTION, 
USE AND DISCLOSURE*0OF 
PERSONAL HEALTH INFORMATION 


nder the Québec Private Sector Act, personal health information is not granted any “special 

status.’ With the exception of sections 37-38 of the Québec Private Sector Act, which grant 

enterprises grounds to temporarily refuse an individual's request to access his or her file,'™ 
the Act covers personal health information generally in the same manner as it does with other 
personal information. 


A major controversial aspect of the Québec Private Sector Act is with the treatment of personal 
health information an employer holds after it orders a medical test. Though initially, the Act was 
not interpreted as creating any obstacles for employees seeking to accessing their personal health 
information,'' the CAI in one case agreed to apply the “impact on judicial proceedings” exception 
at subsection 39 (2) as ground for refusing access.'** However, in the context of labour relations, 
where access to personal health information is obtainable under the Act respecting industrial 
accidents and occupational diseases,'** the CAI recognized that more generous legislation should 
take precedence over the Québec Private Sector Act’s more restrictive exceptions to access.!™ 


In Québec, there are other statutes that deal specifically with personal health information. 


For example, sections 17 to 28 of the Act respecting health services and social services ‘°° establish 
a “mini-code” governing a person's right of access and rectification with respect to his or her 
personal health information held by hospitals and other health organizations in the public sector. 
This “mini-code” can be summarized as follows: 


150 See case law under paragraph 5.2.1. . 
151 Adam v. Gauthier, [1997] CAI 18; De Bellefeuille v. Clinique Médiavis inc., [1999] CAI 1. 
1582 Papaeconomou Vv. Pratt & Whitney Canada, {2000} CAI 41. 

SE R.S-O5 €. Ara.00L. 

‘4 Malenfant v. Caisse populaire Desjardins de LAncienne-Lorette, [1996] CAI 218. 


15 RS.Q.,c. $-4.2. 
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a) The principle set out in section 17 is clear — every user 14 years of age or over has a right 
of access to his record, except, as set out in section 37 of the Québec Private Sector Act, 
where disclosure would be seriously prejudicial to the user’s health. Users under 14 are 
not entitled to access health information otherwise than through the holder of parental 
authority or a court order;!*° 


7 except employees of medical institutions, are 


b) According to section 18, third parties, 
protected, as in section 40 of the Québec Private Sector Act. The information related 
to third parties contained in one’s medical file may be communicated only with written 


approval of this third party; 


c) According to section 19, personal health information of another user is confidential,'** 
can only be accessed with that user’s consent or on a court order. There are many 
exceptions to consent, including when there is reasonable cause to believe that there 
is an imminent danger of death or serious bodily injury,'? 
access is requested for study, teaching or research purposes; 


and in specific cases where 
160 


d) In the case of death, heirs and family members have special rights of access to the 
deceased’s health information under section 23; 


e) The institution must provide prompt access to medical records and provide assistance 
in order to help the user understand the information;’®! 


f) According to section 27, a user to whom an institution refuses access may have 
recourse to different tribunals: Court of Québec, Superior Court, Commission d’accés a 
linformation and Administrative Tribunal of Québec; 


g) According to section 28, this Act takes precedence over the ATI. 


Bill 83, entitled An Act to amend the Act respecting health services and social services and other 
legislative provisions, has been tabled before the Québec National Assembly. If enacted, this Bill 
will amend 40 different Québec statutes. The changes related to the handling and management of 
personal health information can be summarized as follows (in the Explanatory Notes): 


As regards the flow of clinical information, the bill proposes a 
certain number of new situations in which information contained 
in a user’s record may be communicated without the user’s consent 
if that communication is necessary for the purposes specified. 


156 Sections 20 and 21. 

‘87 An exception is made for user’s representatives, section 22. 

#8 X. v. Centre hospitalier de !'Université de Montréal, [2003] CAI 524. 
1 Section 19.0.1. 


‘© Sections 19.1 and 19.2. Bill 83 before the National Assembly of Québec proposes to regroup the exceptions to the 
consent requirements on the disclosure of personal health information, including some new exceptions. 
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The bill also provides for the establishment of storage services for 
certain information concerning a person who consents to its being 
stored. The objective of such services is to provide authorized 
health and social service providers with pertinent and up-to- 
date information in order to facilitate a rapid examination of a 
person's health information when that person is taken in charge 
or is provided health services by those health and social service 
providers, and to ensure the continuity and complementarity 
of the services with those provided by other health and social 
service providers. Another objective of the storage services is to 
ensure the effectiveness of any subsequent communication of 
information stored by an agency or institution authorized by the 
Minister to offer such services for the sole purpose of providing 
health services. 


The bill provides that a person may consent to storage, for five 
years, of personal information contained in records kept by 
different health and social service providers situated in the area of 
jurisdiction of an agency, and may revoke consent at any time. 


The bill sets out a certain number of principles regarding the rights 
of the persons concerned with respect to the information stored 
by an authorized agency or institution and that must be respected 
in applying the proposed legislative provisions. 


One of the main changes proposed by Bill 83 relates to section 19 of the Act respecting health 
services and social services to regroup all exceptions and create a “code of exceptions” allowing for 
disclosure of personal health information without consent, such as: 


a) Where ordered by a court or coroner; 


b) Under the process of studying complaints under the Act (sections 36, 47, 51, 55, 69) and 
for the purposes of the council of physicians, dentists and pharmacists (Section 214); 


c) When conducting inquiries on health or social service institutions (sections 413.2 and 
414); 


d) For the purposes of the Minister, so as to determine general orientations (section 431 
and 433); 


e) For inspectors designated by the Minister in his general supervisory powers (sections 
489 and 489.1); 


f) For the investigation of any matter pertaining to the quality of health services or social 
services and to the administration, organization and operation of an institution or 
regional board (section 500); 
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g) Where there is reasonable cause to believe that there is an imminent danger of death 
or serious bodily injury (section 19.0.1), when it is necessary to ensure that information 
is accurate and updated or in the case of transfer of a user (sections 19.0.2 to 19.0.4), 
where communication is necessary for carrying out a mandate or a service contract 
given to that person (section 27.1) and other miscellaneous exceptions (sections 103, 
108, 108.1, 108.3, 204.1 and 520.3.1); 


h) When requested by a committee created under section 41 of the Health Insurance Act!” 
and section 192 of the Professional Code;'® 


i) And finally, for the general purposes of the Public Health Act.’ 


The only exception not addressed in section 19 concerns study, teaching or research set out in 
section 19.1. 


For further details, see CAI’s review of Bill 83.!° 


Other Québec legislative provisions have an impact on personal health information. For example, 
section 9 of the Québec Charter extends a “quasi-constitutional” protection to professional secrecy. 
Section 42 of the Medical Act'® and sections 20 and 21 of the Code of ethics of physicians’ extend 
the same quasi-constitutional protection of professional secrecy to physicians’ patients. 


Sections 60.4 and 60.5 of the Professional Code,'** which applies to statutorily recognized 
professionals, including physicians, registered nurses, physical therapists and occupational 
therapists, establish a set of rules governing the disclosure of some information these professionals 
have about their clients. Moreover, following the Supreme Court of Canada decision in Smith v. 
Jones,’ the Professional Code was amended in order to allow professionals to disclose information 
“in order to prevent an act of violence, including a suicide, where he has reasonable cause to believe 
that there is an imminent danger of death or serious bodily injury to a person or an identifiable 
group of persons.”'”° 


*61 Sections 25 and 26. 
PARES Ole (a Neves) 
ISP RESTOR CiG-26" 
ETA Si CRS =D es 


165 Mémoire sur le Projet de loi no 83, Loi modifiant la Loi sur les services de santé et les services sociaux et dautres 
dispositions législatives, URL : [http://www.cai.gouv.qc.ca/06_documentation/01_pdf/Memoire-PL%2083%20(final). 
pdf] 


HEIR SAO) Cx ES): 

107 M-9, r. 4.1. 

ERES OncaG-26: 

D2 (LOOS | PRi€ SA 55s 
Subsection 60.4 (2). 
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With respect to accessing his or her file, the client of a professional enjoys basic rights under the 
Professional Code including the right of access'”! and correction.'”? However, one must look to the 
specific regulations annexed to the Code which include the codes of ethics of various professional 
groups to find more specific rules on confidentiality and access.'” 


In conclusion, personal health information is regulated by many laws and regulations that have three 
goals: allowing individuals access to information on them, protecting their personal information, 
and balancing these rights with the protection of the public. 


171 Section 60.5. 


172 Section 60.6. 
"3 For example, sections 94 to 102 of the Code of Ethics of physicians, M-9, r. 4.1. 
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